Cyberattack on Hospital Billing Provider Exposes Patient Data at Five German Hospitals
Summary
A cyberattack on an external billing provider reportedly exposed data of tens of thousands of patients at five Baden-Württemberg university hospitals. The clinics say their own IT was unaffected and halted data transfers.
Key points
- The attack on an external hospital billing provider occurred in mid-April 2026.
- Hospitals in Freiburg, Heidelberg, Tübingen, Ulm and Mannheim reported affected patients and stolen data.
- Freiburg reported that records for about 54,000 patients included identifying details; billing data that could reveal diagnoses or treatment was involved in 900 cases, and bank details in a very small number.
- Heidelberg reported about 11,000 affected people; the other hospitals also reported affected patients, with the types of exposed data varying by clinic.
- Freiburg said patients covered by standard statutory health insurance were not affected; the provider handled billing for privately insured, supplementary-insured and self-paying patients.
- The clinics stopped sending data to the provider. Freiburg said data protection authorities and the BSI were informed on April 16, and the breach's scale was established on May 18.
- The Baden-Württemberg science ministry said the hospitals' own IT systems were not affected.
Article Details
- Victim Organization
- Unimed
- Incident Type
- Cyberattack on an external hospital billing provider resulting in theft of patient data
- Disclosure Date
- 2026-05-21
- Data Types Exposed
- Names
- Dates of birth
- Addresses
- Billing records
- Diagnosis and treatment information
- Financial data
- Bank account details
- Affected Records
- Tens of thousands of patients across affected hospitals. Reported figures include approximately 54,000 patients at Freiburg, 11,000 at Heidelberg, several thousand at Tübingen, approximately 1,600 at Ulm, and 3,000 at Mannheim.
- Operational Impact
- The affected hospitals stopped transferring data to the provider. The hospitals' own IT systems were not affected, and the article reports no disruption to hospital operations.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed