France fines Saint-Étienne hospital €500,000 over breach hitting 727,000 people

Key points

• France's data protection regulator CNIL fined Hôpital privé de la Loire €500,000 (about $580,000) for security failings tied to a 2025 breach.
• The attack exposed data on 524,867 patients and 202,246 relatives or trusted contacts, totalling more than 727,000 people.
• A teenager using the name "Marak" broke in through a single doctor's account and spent days extracting records undetected.
• CNIL found no multi-factor authentication for external users, weak access controls, and no real-time monitoring.
• The hacker tried to sell the data for between €2,000 and €5,000 but, by later reports, never found a buyer.

France's data protection authority, CNIL, has fined Hôpital privé de la Loire €500,000 for failing to protect patient records that ended up in the hands of a teenage hacker.

The hospital, known as HPL, sits in Saint-Étienne and belongs to the Ramsay Santé group. It handles surgery, maternity, cancer care and intensive-care services, and sees around 60,000 patients a year across 333 beds.

In the summer of 2025, an attacker got into HPL's electronic patient record system and pulled out sensitive data on 524,867 patients. Another 202,246 people listed as trusted third parties, usually relatives or emergency contacts, were also caught up in it: more than 727,000 individuals in total.

How did the hacker get in?

Through one doctor's account. A teenager using the alias "Marak" told French newspaper Le Progrès over Telegram that the whole intrusion started with a single compromised login, which then opened the door to the hospital's entire internal system.

Once inside, the intruder wasn't stopped by any of the barriers you'd expect. External users, including doctors in private practice logging in remotely, could reach the system without a VPN (a private encrypted connection that shields remote access) and without multi-factor authentication, the extra one-time code or app prompt that stops a stolen password from being enough on its own. The one compromised account could see records for every patient in the building, not just those the doctor treated. And nobody was watching: HPL had no real-time or near-real-time monitoring, so the hacker hauled out data over several days without triggering an alert.

What did the regulator actually punish?

Breaches of the EU's General Data Protection Regulation, or GDPR, the bloc's main privacy law. Specifically, CNIL cited Article 32, which requires organisations to keep personal data secure, and Article 34, which forces them to notify affected people when something goes wrong.

HPL informed patients after the breach but didn't directly notify the 202,246 trusted third parties whose data was also taken. CNIL flagged that as a separate failure. The hospital tightened its security during the proceedings, which likely kept the fine from going higher. Our 17 August report on France's tax-office breach showed a similar pattern: a criminal listing stolen records for sale before the affected authority had finished telling people what was taken.

Should patients be worried?

The data was reportedly never sold or published, according to follow-up reporting by BleepingComputer. "Marak" tried to offload it to a single buyer and found no takers.

That's not a guarantee it stays buried. Anyone treated at HPL, or listed as a contact for someone who was, should treat unexpected communications referencing their hospital visit with suspicion, especially any request for bank details or ID numbers. Health data is prized by fraudsters because it lends credibility to scams.

For hospitals watching from elsewhere in Europe, CNIL's message is blunt: one weak login shouldn't open every record in the building.