French hospital fined €500,000 after data breach exposing 727,000 records

{"heading_1":"Hospital's Security Failures","paragraph_1":"The French data protection authority (CNIL) fined Hôpital privé de la Loire (HPL) €500,000 for inadequate data protection, following a breach that exposed sensitive data of 524,867 patients and 202,246 trusted third parties.","paragraph_2":"CNIL's investigation identified several security lapses, including unsecured access to the electronic patient record system by external users and a lack of real-time monitoring and alerting.","paragraph_3":"HPL employed 650 staff, including 180 doctors, and had 333 beds, with 60,000 patients annually. The breach occurred in the summer of 2025, with the hacker using the alias 'Marak' claiming responsibility.","paragraph_4":"The hacker accessed the system using a single doctor's account, which led to the breach of the entire internal system. The breach was reported to a French outlet, Le Progrès, via Telegram.","paragraph_5":"CNIL noted that HPL took several security measures during the proceedings, including strengthening its security protocols and informing affected patients but not the 202,246 trusted third parties whose data was also stolen.","paragraph_6":"The breach violated Article 32 and Article 34 of the GDPR, which require adequate protection of personal data and the right to be informed of data breaches.","paragraph_7":"The hacker attempted to sell the stolen data to a single buyer but was unsuccessful. The breach affected 727,000 records, including patient and third-party data, with the hacker claiming the data was worth between €2,000 and €5,000.","paragraph_8":"The breach underscores the importance of robust security measures, including multi-factor authentication, real-time monitoring, and secure access controls, to protect sensitive data in healthcare settings."}