Saint-Étienne Hospital hit with $580,000 fine after data breach exposed 727,000 people's records

Hôpital privé de la Loire has been fined 500,000 euros, or about $580,000, by France’s data protection authority after failing to adequately secure patient data ahead of a breach last summer that exposed information belonging to more than 727,000 people.

Hôpital privé de la Loire is a general hospital in Saint-Étienne and part of the Ramsay Santé healthcare group, offering medical, surgical, maternity, cancer, intensive-care and emergency services. The facility has 333 beds across five clinical divisions, employs 650 staff members including 180 doctors, and treats roughly 60,000 patients a year.

In the summer of 2025, an attacker gained access to the hospital’s centralized electronic patient record system, known as the Computerised Patient Summary, and extracted data belonging to 524,867 patients along with 202,246 people designated as trusted third parties, such as those who accompanied or assisted patients. The compromised information included health data.

The CNIL’s subsequent investigation found the hospital had violated Article 32 and Article 34 of the General Data Protection Regulation. Investigators determined that external users, including private-practice physicians, could log into the patient record system without a VPN or multifactor authentication, a gap the attacker exploited to gain entry. The hospital’s access controls were also found to be insufficient, since they did not restrict data access based on a patient’s actual care team, allowing the single compromised account to reach records for the hospital’s entire patient population.

In addition, the CNIL found the hospital had no real-time or near-real-time monitoring or alert system in place, which let the attacker explore the system and remove a large volume of data over several days without being detected. The regulator also noted that the hospital did not directly notify the 202,246 trusted third parties whose information was taken, even though affected patients were informed.

In setting the fine, the CNIL’s restricted committee, the body responsible for issuing sanctions, cited the hospital’s lack of familiarity with basic security principles, the number of people affected, the sensitivity of the compromised data and the hospital’s financial capacity. The committee also acknowledged that the hospital had since taken steps to strengthen its security during the proceedings and ordered it to complete those measures within three to 15 months, depending on the type of safeguard involved.

A teenage hacker using the alias "Marak" claimed responsibility for the breach, telling French outlet Le Progrès over Telegram that the attack began with the compromise of a single doctor’s account, which provided access to the hospital’s entire internal system. The hacker attempted to sell the stolen data to a single buyer for between 2,000 and 5,000 euros, though it was later reported that the data was neither sold nor published.