French hospital fined €500,000 after massive data breach

French hospital fined €500,000 after data breach

The CNIL has slapped Hôpital privé de la Loire with a ↓ €500,000 penalty for lax safeguards that left 727,000 patient and relative records exposed ↓ 727,000 records.

Authorities discovered the breach when a former employee uploaded a spreadsheet to a public cloud service, triggering an audit that revealed systematic failures in encryption and access control.

“The scale of this incident is unacceptable for any health institution,” said CNIL spokesperson Reuters reported.

Under the GDPR, fines can reach up to 4% of annual turnover, making this sanction one of the heftiest in French health‑care history.

Legal experts warn that similar institutions may face comparable penalties unless they overhaul data‑handling protocols, a move echoed by Bloomberg‘s recent analysis.