France

Hôpital privé de la Loire

500,000 €

GDPR enforcement action by French Data Protection Authority (CNIL) on 2026-07-21.

Rank · Sector

#17

of 286 in Health Care

Rank · France

#35

of 75

Rank · All fines

#259

of 3,170

Case details

Authority: French Data Protection Authority (CNIL)
Date: 2026-07-21
Controller / Processor: Hôpital privé de la Loire
Sector: Health Care
Quoted Articles: Art. 32 GDPR, Art. 34 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The French DPA has imposed a fine of EUR 500,000 on Hôpital privé de la Loire. In a cyberattack hackers gained access to the controller's Computerised Patient Summary thereby gaining access to the personal data of 524,867 patients and 202,246 third parties. An investigation found that the controller had not implemented adequate measures to ensure the security of personal data, such as VPNs, multi-factor authentication (MFA) or access restrictions. While the controller did inform its patients about the security breach, it did not inform the aforementioned third parties whose personal data was also affected by the attack.

Open original source Links to the regulator's original publication or another source.