A healthcare data breach exposed 727,000 records at a French hospital after MFA failure and weak access controls let one compromised login go undetected for days.
France’s data protection authority just handed down a costly reminder about identity security. CNIL fined Hôpital privé de la Loire (HPL) €500,000 after a healthcare data breach exposed data tied to more than 727,000 people. The incident shows how a single compromised account can escalate into a mass patient-record exposure when organizations skip MFA, over-provision access, and fail to monitor their systems in real time. The most damning detail: the hospital’s own patient record software had shipped with built-in MFA since 2024. It simply was never turned on for external physicians. For any enterprise managing sensitive data, this case is a direct lesson in what happens when identity security takes a back seat.
During the summer of 2025, an attacker gained access to HPL’s electronic patient record (EPR) system, which centralizes data for everyone the hospital treats. The intrusion reportedly began with the compromise of a single doctor’s account. From there, the attacker moved through the system undetected and extracted data belonging to 524,867 patients and 202,246 individuals listed as trusted third parties, bringing the total number of people affected to more than 727,000.
CNIL’s investigation, and its formal decision issued in September 2026, found that HPL had failed to implement several basic security measures that could have made the attack significantly harder to carry out. The regulator cited the hospital for violating GDPR Article 32 (failure to ensure data security) and Article 34 (failure to notify all affected individuals), noting that while patients were informed, the 202,246 trusted third parties were not.
Notably, the attacker, using the alias “Marak,” attempted to sell the dataset to a single buyer for between €2,000 and €5,000. The data was reportedly never sold or published. Yet CNIL still issued the €500,000 fine, underscoring that regulators penalize the security failures that created the exposure, not just the damage that follows a leak.
CNIL’s findings point to a chain of preventable failures rather than a single point of compromise.
Weak remote authentication: External users, including private-practice physicians connecting from outside the hospital network, could log into the EPR without a VPN or multi-factor authentication. This wasn’t a technology gap: the EPR vendor had made MFA available since 2024. The hospital simply never enabled it for these external accounts, leaving a critical entry point protected by nothing more than a username and password.
Overbroad access controls: Once inside, the compromised account was not restricted to the records a single physician would need. Inadequate access controls let it reach patient data across the entire hospital, turning one weak credential into a master key.
Insufficient data segmentation: Sensitive medical-secrecy data was not limited to the care teams actively treating a given patient, widening the blast radius of any single account compromise.
No real-time monitoring: The hospital had no near-real-time monitoring or alerting in place. This gave the attacker days to explore the system and quietly extract large volumes of records without triggering any response.
A hacker using the alias “Marak” later claimed responsibility for the attack, reportedly stating it began with the compromise of one doctor’s credentials, a detail that lines up with CNIL’s own findings.
Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.
Download the Resource KitThis case is relevant well beyond hospital IT teams. It touches enterprise identity and access management, XDR, endpoint visibility, and regulatory compliance across any industry that handles sensitive data. The pattern is a familiar one: weak or missing MFA, excessive account privileges, and delayed detection combine to turn a single credential compromise into a large-scale breach. CNIL’s decision also underscores that regulators are willing to impose significant fines not just for the breach itself, but for the absence of basic, well-understood security controls.
Hexnode gives organizations the tools to close exactly the gaps that led to HPL’s breach.
Hexnode UEM establishes a device compliance baseline before any clinician, contractor, or administrator can reach a sensitive system. It enforces mandatory full-disk encryption and current OS patch levels while automatically deploying VPN configurations. It also blocks unmanaged doctors’ devices before they can access the network.
Hexnode XDR detects anomalous endpoint activity as it happens, not days later. It catches behaviors like mass file downloads to local storage, unauthorized script execution, and USB exfiltration attempts, correlating these signals across the device fleet and mapping attack chains to the MITRE ATT&CK framework, and closing the visibility gap that let HPL’s attacker operate undetected for days.
Combined, Hexnode’s native integration with Microsoft Entra ID Conditional Access and Okta Device Trust limits sensitive systems to trusted users on managed, compliant devices, cutting off the kind of unrestricted remote access that made this breach possible in the first place.
A VPN creates an encrypted tunnel between a remote device and the internal network, controlling where a connection can come from. MFA verifies who is connecting by requiring a second proof of identity beyond a password. Both serve different layers of defense, so using only one leaves a gap that attackers can exploit, as seen when external users could log in without either control.
Without near-real-time monitoring, breaches often go undetected for days or even longer, since there’s no automated system flagging unusual access patterns. This delay gives attackers time to explore systems and extract large volumes of data before anyone notices. Real-time or near-real-time alerting is essential for shrinking this detection window.
The Hôpital privé de la Loire fine reinforces a simple truth: healthcare breach prevention depends on identity controls, endpoint posture, least privilege, and real-time detection working together. Enterprises should treat missing MFA and excessive account access as breach-enabling conditions, not just checkboxes on a compliance audit. The cost of getting this wrong isn’t only regulatory. It’s the trust of every patient, physician, and partner whose data sits inside the system.
Secure accounts, enforce trusted access, and accelerate threat response with Hexnode UEM and XDR.
Start Your Free Trial!
