Nothing in the chain CNIL laid out required a novel technique. External users of the patient record system, including private-practice physicians, could reach it with no VPN and no multi-factor authentication [5]. Authorization inside the system was flat, so the one compromised account could pull records for every patient in the hospital [6]. There was no real-time or near-real-time monitoring, which is why the attacker browsed and extracted a large volume of data across several days with nobody watching [7].
A teenager using the alias Marak claimed the intrusion, telling the Saint-Étienne daily Le Progrès over Telegram that it began with a single doctor's account and opened onto the entire internal system [10]. That account of the entry point comes from the attacker, not from the regulator. It is consistent with what CNIL found about access scoping, and it is the part of the story that remains unverified.
The arithmetic is the part that travels into a budget conversation. 524,867 patients plus 202,246 trusted third parties is 727,113 people [1], and €500,000 divided across them is about 69 cents each [2]. HPL reports roughly 60,000 patients a year [4], so the stolen set is a little over twelve years of intake [5]. Marak tried to sell it to one buyer for €2,000 to €5,000 [12]. The fine is at least a hundred times the top of that range [4]. Whatever the data was worth to a buyer, the regulator valued the failure to protect it far higher.
The Article 34 finding tends to get skipped in a readout of a case like this. HPL told the patients and did not directly notify the 202,246 trusted third parties whose data was also taken [8], which is 27.8% of the affected population [3] left to hear about it some other way. These are people who escorted a patient or helped one [11]; they never chose a relationship with the hospital, and they had no route to act. CNIL cited Article 32 for the security failures and Article 34 for the notification gap in the same decision [9].
CNIL also recorded that HPL strengthened its security during the proceedings [13]. That went in as mitigation, not as grounds to drop the sanction. For a hospital with 650 staff, 180 of them doctors, and 333 beds across five clinical divisions [4], every item on the regulator's list is a configuration and monitoring decision rather than a capital program: a VPN and MFA requirement for outside clinicians, role scoping in the record system, and an alert on bulk record reads. That is the comparison to bring to a finance discussion. The controls have a known cost, and the decision now attaches one to skipping them as well.
