{"id":"unimed-hospital-patient-data-breach-may-2026","category":"breach","status":"closed","title":"Unimed breach steals German hospital patients’ personal, health and billing information","tldr":"Attackers stole German hospital patients’ data through billing provider Unimed, including around 54,000 patients in Freiburg and around 30,000 in Cologne. Read your notification letter and verify unexpected hospital bills or payment requests directly.","summary":"Attackers breached German hospital billing provider Unimed in April, stealing personal information and billing-dispute correspondence. Those affected include privately insured patients, self-paying patients and people with private supplementary cover. Freiburg reported around 54,000 affected patients and Cologne around 30,000; other hospitals also disclosed thefts. Most exposed information was basic personal data, but some records included diagnoses, treatment details, correspondence or bank information. Hospitals said their own clinical systems and patient care were unaffected. Unimed said it secured its systems and restored normal operations; there is no patient software update to install. Its incident page, dated 10 June, reports no evidence that the stolen information was published or misused. Oberschwabenklinik subsequently confirmed around 700 affected patients on 13 August and said all identified patients had been notified. The sources reviewed through 3 November do not establish recovery of the stolen data or criminal charges.","action":"Read any notification from your hospital or Unimed to find out which information was stolen. Verify unexpected bills, payment changes or requests for personal information directly with your hospital using its published contact details; Unimed says it never asks by email or phone for payment to a new or changed bank account. There is no update to install on your devices.","product":"Unimed hospital billing service in Germany","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["unimed","germany","healthcare","patient-data","data-breach"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Informationen zum Cyberangriff auf unimed","url":"https://www.unimed.de/sicherheit/","by":"Unimed","date":"2026-06-10"},{"kind":"advisory","title":"Unimed statements on system recovery and patient notification","url":"https://www.unimed.de/presse/","by":"Unimed","date":"2026-05-29"},{"kind":"advisory","title":"Cyberangriff auf externen Dienstleister betrifft auch Daten von Patient*innen des Universitätsklinikums Freiburg","url":"https://www.uniklinik-freiburg.de/presse/pressemitteilungen/detailansicht/6807-cyberangriff-auf-externen-dienstleister-betrifft-auch-daten-von-patientinnen-des-universitaetsklinikums-freiburg.html","by":"Freiburg University Hospital","date":"2026-05-21"},{"kind":"advisory","title":"Cyberkriminelle entwenden Patientendaten bei externem Abrechnungs-Dienstleister","url":"https://www.uk-koeln.de/uniklinik-koeln/aktuelles/detailansicht/cyberkriminelle-entwenden-patientendaten-bei-externem-abrechnungs-dienstleister/","by":"Cologne University Hospital","date":"2026-05-21"},{"kind":"advisory","title":"Update: Daten von 2.764 Patient:innen der Universitätsmedizin Mainz betroffen","url":"https://www.unimedizin-mainz.de/newsroom/neuigkeiten/aktuelle-meldungen/newsdetail/article/update-cyberangriff-auf-externen-abrechnungsdienstleister-daten-von-2764-patientinnen-der-universitaetsmedizin-mainz-betroffen.html","by":"University Medical Centre Mainz","date":"2026-06-05"},{"kind":"advisory","title":"Datenschutzvorfall bei Unimed","url":"https://www.oberschwabenklinik.de/service/aktuelles/detailseite/informationen-zum-cyberangriff-auf-den-abrechnungsdienstleister-unimed.html","by":"Oberschwabenklinik","date":"2026-08-13"},{"kind":"news","title":"Hackers steal patient and billing data from German hospitals via third-party provider","url":"https://therecord.media/hackers-steal-patient-billing-data-german-hospitals","by":"The Record","date":"2026-05-21"},{"kind":"news","title":"Was über den Cyberangriff auf Kliniken bekannt ist","url":"https://www.tagesschau.de/inland/gesellschaft/cyberangriff-kliniken-100.html","by":"Tagesschau","date":"2026-05-23"}],"started":"2026-05-21","closed":"2026-08-13","created":"2026-11-03T20:47:38.571Z","updated":"2026-11-03T20:47:38.571Z","cve_notes":[],"timeline":[{"at":"2026-08-13","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Oberschwabenklinik confirmed around 700 affected patients and said it had individually notified everyone identified as affected. The stolen records predated its departure from Unimed at the end of 2025; it reported no stolen bank account details or evidence of misuse.","url":"https://www.oberschwabenklinik.de/service/aktuelles/detailseite/informationen-zum-cyberangriff-auf-den-abrechnungsdienstleister-unimed.html","by":"Oberschwabenklinik","patch":null},{"at":"2026-06-10","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Unimed’s updated incident page described the security incident as concluded, with monitoring continuing and no evidence of publication or misuse of the stolen data. It warned patients to check unexpected billing messages and payment requests.","url":"https://www.unimed.de/sicherheit/","by":"Unimed","patch":null},{"at":"2026-06-05","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"University Medical Centre Mainz confirmed 2,764 affected patients: 2,142 with basic personal information exposed, 621 with additional health information and one with financial information. It said personal notification letters were being sent in early June.","url":"https://www.unimedizin-mainz.de/newsroom/neuigkeiten/aktuelle-meldungen/newsdetail/article/update-cyberangriff-auf-externen-abrechnungsdienstleister-daten-von-2764-patientinnen-der-universitaetsmedizin-mainz-betroffen.html","by":"University Medical Centre Mainz","patch":null},{"at":"2026-05-22","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Unimed said attackers had stolen billing-dispute correspondence before being stopped, but had failed to encrypt its systems. It said external specialists had secured the systems and normal operations had resumed.","url":"https://www.unimed.de/presse/","by":"Unimed","patch":null},{"at":"2026-05-21","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Cologne University Hospital reported around 30,000 affected patients, including 843 cases involving health information and five involving financial information. It announced individual notification letters and said it had filed a criminal complaint.","url":"https://www.uk-koeln.de/uniklinik-koeln/aktuelles/detailansicht/cyberkriminelle-entwenden-patientendaten-bei-externem-abrechnungs-dienstleister/","by":"Cologne University Hospital","patch":null},{"at":"2026-05-21","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Freiburg disclosed stolen names, dates of birth and addresses for around 54,000 patients. About 900 cases also involved invoices potentially revealing diagnoses or treatments; fewer than ten involved bank details.","url":"https://www.uniklinik-freiburg.de/presse/pressemitteilungen/detailansicht/6807-cyberangriff-auf-externen-dienstleister-betrifft-auch-daten-von-patientinnen-des-universitaetsklinikums-freiburg.html","by":"Freiburg University Hospital","patch":null},{"at":"2026-05-18","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Freiburg University Hospital received reliable information about the extent and types of stolen data. It says the data protection authority and Germany’s BSI cybersecurity agency had been informed on 16 April.","url":"https://www.uniklinik-freiburg.de/presse/pressemitteilungen/detailansicht/6807-cyberangriff-auf-externen-dienstleister-betrifft-auch-daten-von-patientinnen-des-universitaetsklinikums-freiburg.html","by":"Freiburg University Hospital","patch":null},{"at":"2026-04-14","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Unimed detected the attack, brought in external investigators and disconnected customer data links. It says it notified the first identified customers the next day.","url":"https://www.unimed.de/sicherheit/","by":"Unimed","patch":"na"}],"url":"https://hard.fyi/live/unimed-hospital-patient-data-breach-may-2026/","json":"https://hard.fyi/api/live?id=unimed-hospital-patient-data-breach-may-2026"}