The CNIL has just sanctioned Hôpital Privé de la Loire with a 500,000-euro fine following a cyberattack that allowed an attacker to access the data of 524,867 patients, including some health information, as well as the data of 202,246 individuals designated as “trusted third parties.”
The attack, which occurred in the summer of 2025, targeted the hospital’s electronic patient record (EPR) system.
What makes this decision notable is less the amount of the fine than the precision with which the CNIL describes the technical weaknesses that allowed the attack to propagate.
For external users, including private practitioners, access to the EPR did not rely on a VPN or on multi-factor authentication.
The CNIL explicitly deemed this authentication process “not sufficiently robust.” The attacker exploited this vulnerability to access the EPR using the credentials of a single user.
A compromised account should not grant access to the entire EPR
However, the weakness did not end at authentication. Once logged in, the attacker could access the data of all patients at the establishment.
The reason lay in a second failure: the authorization policy did not adequately reflect the concept of a care team. Professionals were not limited to the information strictly necessary for the patients for whom they were actually responsible.
For the CNIL, the problem is twofold. A compromised account was made possible by insufficiently robust authentication, and, once compromised, the rights attached to that account allowed access to a substantial volume of data.
Days of exfiltration without alerts
The third weakness highlighted by the CNIL concerns detection.
The establishment lacked measures to identify suspicious activity in the EPR in real time or in the very short term and to trigger an alert. The attacker was thus able to explore the system for several days and extract a large amount of data without the anomalous activity being detected.
The CNIL considers that this absence of detection contributed to the scale of the breach.
The reasoning thus outlines a fairly classic defense chain:
authenticate properly → limit privileges → segment access → log → detect abnormal behavior.
It is this chain, more than the isolated absence of a VPN or MFA, that helps explain the decision.
VPN and MFA become expected safeguards
The case of Hôpital Privé de la Loire is exceptional in the precision with which the CNIL blames the lack of VPN and MFA. Yet it does not represent a rupture with its jurisprudence.
The Commission had already indicated, in January 2025, that organizations holding large databases must implement multi-factor authentication for employees, partners, contractors, and other remote users.
It had also announced that it would tighten its controls on this point from 2026 onward and specified that the absence of MFA could justify opening a sanction procedure.
The CNIL also reminded that this strengthened authentication was already considered, in principle, necessary under the GDPR for databases containing sensitive data or where a breach would pose significant risks.
The recommendation published in April 2025 on multi-factor authentication had laid the groundwork.
The Hôpital Privé de la Loire case thus shows how this doctrine can now be translated into a sanction procedure.
Free: the precedent of a poorly secured remote-access setup
A few months earlier, the CNIL had already directly faulted a remote-access infrastructure.
In January 2026, it levied €27 million on Free Mobile and €15 million on Free, amounting to a total of €42 million, after a major data breach. The Commission notably highlighted the inadequacy of measures to secure subscribers’ data.
This case is particularly instructive when viewed alongside that of the Hôpital Privé de la Loire. The issue is no longer simply whether an organization uses a VPN, but whether the entire remote-access mechanism maintains an appropriate level of security.
Recent jurisprudence thus tends to treat security as a chain of controls rather than a collection of individual products.
France Travail: authentication is not enough
The €5 million penalty imposed on France Travail in January 2026 points in the same direction.
The CNIL notably flagged the insufficiency of logging measures to detect abnormal behavior on the information system. It also found that the authorizations granted to Cap emploi counselors’ accounts were too broad, enabling access to data of people they were not assisting.
Thus we again encounter the two other pillars of the Hôpital Privé de la Loire case: logging and authorization management.
The parallel is telling. In both cases, the risk does not originate solely from the possibility of compromising an account. It also stems from the fact that a compromised account holds overly broad rights and that abnormal activity is not detected quickly enough.
IQVIA: segmentation also enters the radar
The €5 million penalty imposed on IQVIA Operations France in May 2026 further completes this picture.
The CNIL sanctioned the company in relation to two health-data warehouses and examined the safeguards intended to limit the risks associated with these data.
The case underscores the increasing importance the CNIL attaches to security architecture. Authentication, environment separation, access restrictions, and traceability must be considered together when dealing with highly sensitive data.
Logging should not be a mere repository of logs
The CNIL’s stance on logging is particularly revealing.
In its recommendations for large databases, the Commission calls for an architecture capable of tracing access and actions by authorized users. But it stresses that simply collecting logs is not enough: organizations must be able to process this information to quickly detect suspicious behavior.
The CNIL specifically recommends logging access to applications, APIs, systems, and networks, and focusing monitoring on the most sensitive components. The events to monitor should enable the detection of abnormal flows, unusual volumes, or rejected login attempts.
In other words, having logs does not automatically confer detection capability.
That is precisely what the Hôpital Privé de la Loire case demonstrates. The absence of real-time or near-real-time detection allowed the attacker several days to explore the EPR and extract data.
TLS, passwords: older jurisprudence
The CNIL has not discovered cybersecurity building blocks in 2026.
Its 2024 report recorded 11 sanctions for data-security shortcomings. The affected organizations had notably used weak passwords, stored passwords in clear, implemented inadequate authorization policies, or continued to run outdated TLS versions.
The Commission had also sanctioned several organizations that, despite a formal notice, continued to use TLS 1.0 or 1.1, as well as SHA-1, considered obsolete or insufficiently secure.
The logic is the same: the GDPR does not enumerate specific products or technologies to install. It requires data controllers to implement security measures appropriate to the risk and the state of knowledge.
But when certain technologies become essential to meet that level of risk, their absence or misconfiguration can become a central element of the CNIL’s finding.
An obligation to means, not a list of products
Thus, one must avoid a mechanical interpretation of the decision.
The GDPR does not turn VPNs or MFA into universal obligations. Article 32 requires technical and organizational measures “appropriate” to the risk, considering the nature of the processing, the risks involved, the state of knowledge, and the cost of measures.
The CNIL emphasizes this in its jurisprudence: the sufficiency of security measures must be evaluated based on the processing’s characteristics, risks, knowledge, and cost.
This is precisely what makes the Hôpital Privé de la Loire case interesting. The data involved are highly sensitive, the EPR centralizes a substantial amount of information, and external users can access it remotely.
In this context, the combined absence of VPN and MFA constitutes, in the CNIL’s view, a security weakness sufficiently serious to amount to a breach of Article 32.
Towards a CNIL “technical doctrine”?
The decision against Hôpital Privé de la Loire does not create a new regulatory obligation requiring all health facilities to deploy a specific piece of equipment.
Rather, it signals a shift in jurisprudence toward a far more concrete assessment of security architecture.
Authentication, MFA, VPN, access rights, segmentation, logging, detection, encryption: these building blocks are no longer examined solely in terms of documentary compliance. The CNIL seeks to determine whether, in practice, they are robust enough to prevent a compromise or to limit its consequences.
The Commission appears to endorse this direction explicitly. In its recommendations for large databases, it states that it will tighten controls on authentication from 2026 onward and that the absence of this measure could justify sanction proceedings.
