France’s data protection authority (CNIL) has fined Hôpital privé de la Loire (HPL) €500,000 — about $580,000 — for a string of security failures that led to a major patient data breach in the summer of 2025. Attackers gained access to the hospital’s electronic patient record system through a single compromised doctor’s account and extracted sensitive data belonging to 524,867 patients and 202,246 additional individuals listed as trusted contacts or family members — 727,113 people in total. HPL is a 333-bed general hospital in Saint-Étienne operated by the Ramsay Santé group, seeing around 60,000 patients per year.
The CNIL investigation found multiple violations of GDPR Articles 32 and 34: inadequate access controls, insufficient monitoring, and delayed notification to those affected. A teenage hacker using the alias “Marak” later claimed responsibility, telling French outlet Le Progrès that a single physician’s compromised credentials opened a path across the hospital’s entire internal system. The stolen data was listed for sale for between €2,000 and €5,000 but was reportedly never sold or publicly released. The regulator acknowledged that HPL implemented several security improvements during the proceedings, which were taken into account alongside the scale of the breach and the sensitivity of the health records involved.