On 22 August 2026, the Alaxione platform, a health data host, announced a compromise. The toll: 6.8 million patients affected, with personal data, bank details, social security numbers and reasons for consultation exposed. The breach comes in a week when the DGFiP and the Ministry of National Education also reported major incidents. Volume is not the most useful angle. The question that matters for CISOs and DPOs in the health sector is: what does this event reveal about the gaps in your HDS and NIS2 programmes?
Health data is not like other data
The GDPR distinguishes health data from ordinary personal data. Article 9 classifies it as a "special category", whose processing is in principle prohibited except under explicit exceptions. This classification has concrete consequences for your compliance programme.
The first: a breach involving health data is systematically considered likely to result in a high risk to the rights and freedoms of individuals. This automatically triggers GDPR Article 34, that is, the obligation to notify the data subjects in addition to the CNIL. For 6.8 million people, individual notification is a considerable logistical task. It must be intelligible, state the nature of the data exposed, the probable consequences and the measures taken. It cannot wait.
The second consequence: the risk threshold for triggering a data protection impact assessment (DPIA) is reached by nature as soon as health data is processed. Any host or processor that has not carried out a DPIA before deploying a system processing such data is in structural non-compliance, regardless of any incident.
HDS certification: what it covers and what it does not guarantee
Hosting health data in France is subject to HDS certification (Hébergeur de Données de Santé, health data host), issued by bodies accredited by COFRAC, the French accreditation body. This certification requires compliance with the ISO 27001 standard, covering security, incident management and continuity processes. It is required for any host or managed service provider processing health data on behalf of healthcare establishments or healthcare professionals.
Two points remain consistently misunderstood. HDS is a certification of the hosting organisation, not a guarantee of absolute security for the hosted content. An organisation can be HDS-certified and still suffer a compromise if an attack vector falls outside the scope of the certification: an unaudited subcontractor, a compromised administrator access, a vulnerability in a third-party application. The certification attests that the processes exist, not that they withstand every attack.
The second point: HDS certification does not exempt you from NIS2 obligations. These are two distinct frameworks, with distinct authorities and complementary requirements. In France, under the NIS2 transposition decree, healthcare establishments, medical biology laboratories and manufacturers of critical medical devices are classed as "essential entities". Health data hosts of significant size fall into this category. This means the NIS2 regime applies in addition to HDS, not in place of it.
Double notification, once again
An incident involving health data triggers at least two parallel notification channels, with different deadlines.
Under the GDPR, Article 33 requires notification to the CNIL within 72 hours of becoming aware of the breach, if it is likely to result in a risk to the rights and freedoms of individuals. For health data, this risk is presumed to be high. The 72-hour deadline applies to the data controller, not the host: if your HDS provider is compromised, it is up to you, as controller of your patients' data, to notify the CNIL, not the host on your behalf.
Under NIS2, Article 23 requires an early warning within 24 hours of detecting a significant incident, then a full notification within 72 hours, to the ANSSI through the national platform. The definition of "significant incident" in the health sector includes any event affecting the availability, confidentiality or integrity of systems or data. A compromised health data host meets this definition.
Coordinating these two channels remains the main operational friction point. The article on the pitfalls of GDPR and NIS2 double notification details the mechanisms for meeting both deadlines without improvising. The key point: the two notifications cannot share the same hours without a dedicated organisation. Drafting a solid CNIL notification takes time. Collecting the technical elements for the ANSSI notification takes time too. If you have not tested this process before an incident, you will discover it under pressure.
What the August 2026 wave reveals
The Alaxione incident is not isolated. In the week of 18 to 25 August 2026, several major incidents were reported simultaneously in France: the breaches at the DGFiP and the Ministry of National Education claimed by the ZeroBytes group, the Alaxione incident, and smaller incidents in the insurance sector. This simultaneity suggests either a coordinated campaign or common exposure to the same unpatched technical vector.
According to ANSSI's Panorama de la cybermenace 2025, published in March 2026, the health sector accounts for 10% of incidents handled by CERT-FR, making it the second most targeted sector after local authorities. This figure covers the year 2025. The events of August 2026 confirm that the trend has not reversed.
The main exposure is not technical in the usual sense. Maturity audits conducted in the health sector regularly reveal three recurring gaps: incomplete mapping of third-party access to clinical information systems, no network segmentation between the hospital information system and administrative applications, and incident response plans not tested for more than twelve months. NIS2 (Article 21, risk management measures) and HDS requirements (access governance, continuity plan) both address these three points. That they remain persistent gaps means formal compliance is not yet translating into solid operational practice.
Three actions to launch before the end of the quarter
Review the mapping of your HDS subcontractors. Article 28 of the GDPR and Article 21 of NIS2 require your contracts with hosts and subcontractors to include precise security clauses. If your HDS provider is compromised, check: does your contract require it to notify you within what deadline? Does it have a crisis contact available 24/7? These clauses must be verified now, not during an incident.
Test your notification process. An incident simulation exercise takes no more than half a day. It involves your security team, your DPO and your legal department. The goal is to verify that you can draft an admissible CNIL notification and a complete ANSSI alert within the deadlines, with the information available at the time. If you have not done this in the last twelve months, do it before the end of the quarter.
Check the scope of your HDS certification. If your organisation is HDS-certified, verify that the certification scope covers all systems processing health data, including recently developed applications and SaaS tools integrated since the last review. A scope that drifts without being updated exposes your organisation to a compliance gap that neither the CNIL nor the ANSSI would treat as a mitigating circumstance.
The signal this summer sends
On 25 August 2026, Interior Minister Lecornu announced the creation of an interministerial crisis unit and an emergency budget of 200 million euros for cyber response. This signal should not be read as reassurance: the State is strengthening its response capacity, but security obligations rest on the organisations themselves. NIS2 does not change in nature because the State has mobilised resources. Notification deadlines do not get longer. Risk management requirements are not suspended.
For health sector entities classed as essential under NIS2, the August 2026 wave is an opportunity to verify that the gap between your compliance programme and your actual resilience is measured, documented and reduced. Supervisory authorities are not looking for perfect organisations; they are looking for organisations that make traceable progress.