Leak at Hôpital privé de la Loire

On 21 June 2025, Hôpital privé de la Loire — a private hospital in Saint-Étienne operated by the Ramsay Santé group — was reported to have suffered a major patient-data breach. The intrusion took place between 26 June and 1 July 2025, when an attacker using the alias "Marak" reused a doctor's stolen credentials to access the hospital's information system and exfiltrate a large volume of patient records.

Early estimates put the breach at around 126,000 patients, but Ramsay Santé and security researchers later confirmed a much larger scope of up to 530,000 patients — described by researchers as one of the largest medical data leaks ever recorded in France. The attacker gave the hospital a 72-hour deadline to make contact via Telegram and demanded a ransom; no ransomware encryption was deployed and patient care was not disrupted.

Exposed data categories included:

• Last name, first name, date of birth and gender
• Postal address and phone number
• Social-security number (NIR) and insurance details
• Around 45,000 identity documents (ID cards, passports, residence permits)
• Administrative documents and consultation summaries

The hospital said the affected data was essentially administrative in nature and that its care operations were unaffected. It applied corrective measures, filed a criminal complaint (handed to the Paris cybercrime prosecutor / OFAC), and notified the CNIL, the Regional Health Agency (ARS) and CERT Santé, while preparing to warn affected patients of identity-theft risks.