Hôpital Privé de la Loire Ramsay Santé Data Breach
The French Data Protection Authority (CNIL) published a formal sanction against Hôpital Privé de la Loire in Saint-Étienne, a private medical facility operated by the Ramsay Santé group.
Exposed Data Types
1 sensitive6- Medical records
- Names
- Dates of birth
- Phone numbers
- Physical addresses
- Contact information
About This Breach
Threat actors exploited stolen credentials belonging to an affiliated independent physician to penetrate the hospital's Computerized Patient Records system (DPI) due to the absence of multi-factor authentication (MFA) and virtual private network (VPN) requirements. The incident compromised confidential medical and personal records belonging to 524,867 patients, alongside 202,246 registered emergency contacts and trusted third parties, totaling over 727,000 affected individuals. The CNIL issued a €500,000 fine and strict compliance injunctions.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
