Seventy-three records a minute for five days, and nobody noticed

The number to look at is not five hundred thousand euros, and it is not seven hundred thousand people either. It is seventy-three: patient records pulled out every minute, for five days running, without a single alert firing. That rate looks like nothing a human being produces by working, and a system that cannot tell it apart from ordinary work is not a system under watch.

• Entry was made with a doctor's legitimate credentials, compromised elsewhere: from the system's point of view it was an authorised login.
• Multi-factor authentication was not enabled on the patient record system, which would have made those credentials useless on their own.
• There was no tool able to detect abnormal activity: no thresholds, no alerts, no logs anybody was reading.
• The CNIL ordered a review of access authorisations within fifteen months and effective access logging within three, with a penalty of 1,000 euros for each day of delay.

The two orders show how the authority read the case. Three months for the logs, fifteen for the authorisations: the different deadlines are not leniency, they are a priority. Reviewing who may see what in a hospital is long work and has to be done properly; noticing that somebody is downloading the archive is something you must be able to do now.

Article 32 requires measures appropriate to the risk, and on a health archive the risk is not only that somebody gets in: it is that they stay in unseen. Prevention has a known limit — credentials get stolen, and these had been stolen elsewhere — while detection is the only thing that works after prevention has already failed. It is the part that always comes second in the budget, and it is the part the CNIL measured.