Cybersecurity Policy Report, Information Security Failures Lead to Fine for French Hospital, (Sep 3, 2026)

By Tony Foley

The French data protection authority, the Commission nationale de l’informatique et des libertés, has fined the Hospital de la Loire 500,000 euros ($582,000) for failing to take appropriate steps to ensure the health data of its patients and their relatives, leading to a 2025 data breach of over 700,000 people.

CNIL said in press release today that in the summer of 2025, an attacker was able to connect to the electronic patient record of the hospital, which centralized the data of all people bring treated, as well as other people designated as “trusted third parties.” The agency found that, on the date of the breach, the hospital had not implemented certain basic security measures, like using a VPN or establishing multifactor authentication. In addition, the hospital did not take measures to identify suspicious activity within the electronic patient record. Given the number of records and the nature of the data processed, CNIL found that the hospital’s measures were insufficient to ensure their confidentiality, as required under article 32 of the European Union’s General Data Protection Regulation (GDPR).

The agency further found that, while the hospital notified patients affected by the data breach as provided in GDPR article 34, it provided no information to the more than 200,000 people designated as trusted third parties, despite the fact that their personal data also was stolen by the attacker.

The text of CNIL’s deliberations on the proceeding, which were completed in July, may be downloaded from the press release.

News: InternationalLegislation LitigationEnforcement DataSecurity DataBreach DataPrivacy GDPR