Unimed breach steals German hospital patients’ personal, health and billing information
Attackers stole German hospital patients’ data through billing provider Unimed, including around 54,000 patients in Freiburg and around 30,000 in Cologne. Read your notification letter and verify unexpected hospital bills or payment requests directly.
Read any notification from your hospital or Unimed to find out which information was stolen. Verify unexpected bills, payment changes or requests for personal information directly with your hospital using its published contact details; Unimed says it never asks by email or phone for payment to a new or changed bank account. There is no update to install on your devices.
What’s happening
Attackers breached German hospital billing provider Unimed in April, stealing personal information and billing-dispute correspondence. Those affected include privately insured patients, self-paying patients and people with private supplementary cover. Freiburg reported around 54,000 affected patients and Cologne around 30,000; other hospitals also disclosed thefts. Most exposed information was basic personal data, but some records included diagnoses, treatment details, correspondence or bank information. Hospitals said their own clinical systems and patient care were unaffected. Unimed said it secured its systems and restored normal operations; there is no patient software update to install. Its incident page, dated 10 June, reports no evidence that the stolen information was published or misused. Oberschwabenklinik subsequently confirmed around 700 affected patients on 13 August and said all identified patients had been notified. The sources reviewed through 3 November do not establish recovery of the stolen data or criminal charges.
- What
- Breach
- Affects
- Unimed hospital billing service in Germany
- Fixed in
- Nothing to patch
- Since
- 21 May 2026
- Closed
- 13 Aug 2026
Timeline
- Update
Oberschwabenklinik confirmed around 700 affected patients and said it had individually notified everyone identified as affected. The stolen records predated its departure from Unimed at the end of 2025; it reported no stolen bank account details or evidence of misuse.
- Update
Unimed’s updated incident page described the security incident as concluded, with monitoring continuing and no evidence of publication or misuse of the stolen data. It warned patients to check unexpected billing messages and payment requests.
- Update
University Medical Centre Mainz confirmed 2,764 affected patients: 2,142 with basic personal information exposed, 621 with additional health information and one with financial information. It said personal notification letters were being sent in early June.
- Update
Unimed said attackers had stolen billing-dispute correspondence before being stopped, but had failed to encrypt its systems. It said external specialists had secured the systems and normal operations had resumed.
- Made public
Cologne University Hospital reported around 30,000 affected patients, including 843 cases involving health information and five involving financial information. It announced individual notification letters and said it had filed a criminal complaint.
- Made public
Freiburg disclosed stolen names, dates of birth and addresses for around 54,000 patients. About 900 cases also involved invoices potentially revealing diagnoses or treatments; fewer than ten involved bank details.
- Update
Freiburg University Hospital received reliable information about the extent and types of stolen data. It says the data protection authority and Germany’s BSI cybersecurity agency had been informed on 16 April.
- UpdateNothing to patch
Unimed detected the attack, brought in external investigators and disconnected customer data links. It says it notified the first identified customers the next day.
Sources
- Informationen zum Cyberangriff auf unimedUnimed · 10 June 2026
- Unimed statements on system recovery and patient notificationUnimed · 29 May 2026
- Cyberangriff auf externen Dienstleister betrifft auch Daten von Patient*innen des Universitätsklinikums FreiburgFreiburg University Hospital · 21 May 2026
- Cyberkriminelle entwenden Patientendaten bei externem Abrechnungs-DienstleisterCologne University Hospital · 21 May 2026
- Update: Daten von 2.764 Patient:innen der Universitätsmedizin Mainz betroffenUniversity Medical Centre Mainz · 5 June 2026
- Datenschutzvorfall bei UnimedOberschwabenklinik · 13 Aug 2026
- Hackers steal patient and billing data from German hospitals via third-party providerThe Record · 21 May 2026
- Was über den Cyberangriff auf Kliniken bekannt istTagesschau · 23 May 2026