Massive Cyberattack Exposes Data of Tens of Thousands from Multiple Hospitals

• •Over 54,000 patients from Freiburg and 30,000 from Cologne affected by data theft.
• •Sensitive patient information including names, addresses, and billing details compromised.
• •Attack targeted an external service provider, not the hospitals' internal systems.

A cyberattack on an external service provider has compromised the data of tens of thousands of patients across several university hospitals in Baden-Württemberg, Germany. The attack, which occurred in mid-April 2026, primarily affected private patients, with the Unimed service provider being the target. Hospitals including Freiburg, Heidelberg, Tübingen, and Ulm reported significant data theft, including names, addresses, and billing information. The University Hospital of Freiburg alone confirmed that data from approximately 54,000 patients was stolen, with sensitive financial information compromised in some cases. The University Hospital of Cologne also reported around 30,000 affected patients, with similar types of data stolen. All affected hospitals have ceased operations with the service provider and reported the incident to data protection authorities. The full extent of the breach is still being assessed.