[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQD5Dzr9qwOMzwQFXfunq6mFvprK6vAYPkIDZ0dpsWec":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"de7616be-8f9a-4dd0-8906-a89d03422c2b","CNIL (France) - SAN-2026-009","cnil-france-san-2026-009-6299e2","← Older revision Revision as of 14:47, 15 September 2026 Line 96: Line 96: }} }} The DPA fined a hospital €500,000 for insufficient security measures which enabled a major data breach and for failing to inform 202,246 affected third parties of the breach. The DPA found that a hospital, victim of a data breach, lacked sufficient measures to protect the patients data pre breach and that its reaction to the breach - assigning a shared password and failing to inform 202,246 affected third parties of the breach - was in violation of Articles XX. The DPA fined the hospital €500,000. == English Summary == == English Summary == === Facts === === Facts === In June 2025, an attacker obtained the credentials of a doctor affiliated with Hôpital Privé de la Loire, the controller, and used them to access the hospital's electronic patient record system. Between 26 June and 1 July 2025, the attacker extracted 524,867 patient records. The compromised data included identification and contact information, social security numbers and, in some cases, identity documents and health data. The records also contained personal data relating to 202,246 persons designated by patients as trusted third parties. In June 2025, an attacker obtained the credentials of a doctor affiliated with Hôpital Privé de la Loire, the controller, and used them to access the hospital's electronic patient record system. Between 26 June and 1 July 2025, the attacker extracted 524,867 patient records. The compromised data included identification and contact information, social security numbers and, in some cases, identity documents and health data. The records also contained personal data relating to 202,246 persons designated by patients as trusted third parties. After discovering the breach, the controller notified the CNIL, the DPA, and informed the affected patients through different communication channels. However, it did not directly inform the 202,246 trusted third parties whose data had also been compromised. The DPA subsequently carried out an on-site investigation into the controller's data processing practices. After discovering the breach, the controller notified the CNIL, the DPA, and informed the affected patients through different communication channels. However, it did not directly inform the 202,246 trusted third parties whose data had also been compromised. The DPA subsequently carried out an on-site investigation into the controller's data processing practices. The investigation identified several security deficiencies in the electronic patient record system. External users could access it remotely using only a username and password, without a VPN or multi-factor authentication. Moreover, healthcare professionals could access patient records even when they were not involved in the patient's care, the system lacked adequate proactive analysis of access logs, and the software provider had permanent access to the system without prior authorisation by the controller. Following the breach, the controller had also temporarily assigned the same password to all external practitioners when resetting their credentials. The investigation identified several security deficiencies in the electronic patient record system. External users could access it remotely using only a username and password, without a VPN or multi-factor authentication. Moreover, healthcare professionals could access patient records of patients they had no relation with, the system lacked adequate proactive analysis of access logs, and the software provider had permanent access to the system without prior authorisation by the controller. Following the breach, the controller had also temporarily assigned the same password to all external practitioners when resetting their credentials. === Holding === === Holding === The DPA found that the controller violated [[Article 32 GDPR]] by failing to implement appropriate technical and organisational measures to secure the electronic patient record system. The DPA found that the controller violated [[Article 32 GDPR]] by failing to implement appropriate technical and organisational measures to secure the electronic patient record system.","France's data protection authority (CNIL) has fined Hôpital Privé de la Loire €500,000 for security failures that led to a major data breach. The hospital lacked adequate security measures, allowing an attacker to access and extract over 524,000 patient records, including sensitive health data and social security numbers. Additionally, the hospital failed to notify 202,246 trusted third parties whose data was also compromised, violating GDPR requirements.","France's CNIL fines a hospital €500,000 for data breach and failure to notify third parties.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNIL_(France)_-_SAN-2026-009&diff=53038&oldid=52910","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fthumb\u002F0\u002F0f\u002FLogoFR.png\u002F1200px-LogoFR.png","2026-09-15T14:47:08+00:00","2026-09-15T16:00:45.478174+00:00",8,[17,20],{"name":18,"type":19},"CNIL","vendor",{"name":21,"type":22},"electronic patient record system","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":137},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":80,"name":81,"problem":82,"products":83},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":157},"french-hospital-fined-500k-after-524000-patient-records-breached","French Hospital Fined €500K After 524,000 Patient Records Breached","Hôpital Privé de la Loire failed to implement adequate security controls to protect highly sensitive patient health data, resulting in the unauthorized access and extraction of over 524,000 records including social security numbers. The breach was compounded by the hospital's failure to notify more than 200,000 affected individuals, a direct violation of GDPR's mandatory breach notification requirements. This case illustrates that healthcare organizations face a dual liability risk: the original security failure and the subsequent failure to respond lawfully. Regulators are increasingly penalizing both the breach itself and inadequate incident response, meaning poor security hygiene carries compounding legal and financial consequences.",[143,144,145,146,147,148,149,150,151,152,153,154,155,156],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 33 – Notification of a personal data breach to the supervisory authority","GDPR Article 34 – Communication of a personal data breach to the data subject","NIST SP 800-66 (HIPAA\u002FHealthcare Security)","NIST IR-6 – Incident Reporting","NIST AC-3 – Access Enforcement","NIST SC-28 – Protection of Information at Rest","CIS Control 3 – Data Protection","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27001 – Annex A.8 (Asset Management) and A.16 (Incident Management)","French HDS (Hébergeur de Données de Santé) Certification Requirements",{}]