Le 3 septembre 2026, la Commission nationale de l\u2019informatique et des libert\u00e9s (CNIL) a inflig\u00e9 une amende de 500 000 euros \u00e0 l\u2019H\u00f4pital priv\u00e9 de la Loire pour manquements \u00e0 ses obligations de s\u00e9curit\u00e9 des donn\u00e9es personnelles au titre du r\u00e8glement g\u00e9n\u00e9ral sur la protection des donn\u00e9es (RGPD). Cette sanction intervient \u00e0 la suite d\u2019une violation de donn\u00e9es survenue durant l\u2019\u00e9t\u00e9 2025, au cours de laquelle un attaquant est parvenu \u00e0 se connecter au dossier patient informatis\u00e9 (DPI) de l\u2019\u00e9tablissement, qui centralise l\u2019ensemble des donn\u00e9es des personnes prises en charge.<\/p>\n
L\u2019attaque a permis l\u2019acc\u00e8s aux donn\u00e9es de 524 867 patients, dont certaines donn\u00e9es de sant\u00e9, ainsi qu\u2019\u00e0 celles de 202 246 personnes d\u00e9sign\u00e9es comme \u00ab tiers de confiance \u00bb. Le contr\u00f4le men\u00e9 par la CNIL a mis en \u00e9vidence plusieurs insuffisances dans les mesures de s\u00e9curit\u00e9 mises en \u0153uvre par l\u2019\u00e9tablissement.<\/p>\n
La CNIL rel\u00e8ve un manquement \u00e0 l\u2019article 32 du RGPD relatif \u00e0 la s\u00e9curit\u00e9 des donn\u00e9es personnelles. D\u2019une part, la proc\u00e9dure d\u2019authentification utilis\u00e9e par les utilisateurs externes (notamment les m\u00e9decins lib\u00e9raux) pour acc\u00e9der au DPI n\u2019\u00e9tait pas jug\u00e9e suffisamment robuste, en raison de l\u2019absence de r\u00e9seau priv\u00e9 virtuel (VPN) et de m\u00e9canisme d\u2019authentification multifacteur. L\u2019attaquant a exploit\u00e9 cette vuln\u00e9rabilit\u00e9 pour acc\u00e9der au syst\u00e8me.<\/p>\n
D\u2019autre part, la politique d\u2019habilitation \u00e9tait consid\u00e9r\u00e9e comme inad\u00e9quate, car elle ne tenait pas compte de la notion d\u2019\u00e9quipe de soins permettant de limiter l\u2019acc\u00e8s aux seules personnes effectivement impliqu\u00e9es dans la prise en charge d\u2019un patient. Cette absence de restriction a permis \u00e0 l\u2019attaquant, \u00e0 partir d\u2019un seul compte utilisateur compromis, d\u2019acc\u00e9der aux donn\u00e9es de l\u2019ensemble des patients de l\u2019h\u00f4pital.<\/p>\n
Enfin, l\u2019\u00e9tablissement ne disposait pas de dispositifs permettant de d\u00e9tecter en temps r\u00e9el ou \u00e0 tr\u00e8s court terme une activit\u00e9 suspecte au sein du DPI et de d\u00e9clencher un m\u00e9canisme d\u2019alerte. L\u2019attaquant a ainsi pu explorer le syst\u00e8me pendant plusieurs jours et extraire un volume tr\u00e8s important de donn\u00e9es sans d\u00e9tection de cette activit\u00e9 anormale.<\/p>\n
La formation restreinte de la CNIL, organe charg\u00e9 de prononcer les sanctions, a tenu compte, pour fixer le montant de l\u2019amende, de la m\u00e9connaissance de principes essentiels de s\u00e9curit\u00e9, du nombre de personnes concern\u00e9es, de la nature sensible des donn\u00e9es compromises et des capacit\u00e9s financi\u00e8res de l\u2019H\u00f4pital priv\u00e9 de la Loire. Cette d\u00e9cision illustre les exigences renforc\u00e9es en mati\u00e8re de s\u00e9curit\u00e9 des syst\u00e8mes d\u2019information traitant des donn\u00e9es de sant\u00e9 dans les \u00e9tablissements de sant\u00e9 priv\u00e9s.\u00a0(contenu r\u00e9sum\u00e9 par l’IA)\u200bLire la Suite<\/a>\u200b<\/p>","protected":false},"excerpt":{"rendered":" Le 3 septembre 2026, la Commission nationale de l\u2019informatique et des libert\u00e9s (CNIL) a inflig\u00e9 une amende de 500 000 euros \u00e0 l\u2019H\u00f4pital priv\u00e9 de la Loire pour manquements \u00e0 […]<\/p>\n","protected":false},"author":1,"featured_media":7062,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[33,32],"tags":[195,227],"class_list":["post-16657","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-numerique-en-sante-et-donnees-de-sante","category-numerique-ia-et-transformation-documentaire","tag-cnil","tag-ia"],"_links":{"self":[{"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=\/wp\/v2\/posts\/16657","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16657"}],"version-history":[{"count":0,"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=\/wp\/v2\/posts\/16657\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=\/wp\/v2\/media\/7062"}],"wp:attachment":[{"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16657"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16657"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/veilles-affaires-sociales.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16657"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}