Loading story…
A cyberattack on Unimed, a third-party billing and receivables service provider for German hospitals, exposed data from tens of thousands of patients at multiple university medical centers, including facilities in Cologne, Freiburg, Heidelberg, Ulm, Tübingen, and Mannheim. The intrusion reportedly occurred in mid-April and affected administrative and billing records tied to privately insured patients, self-paying patients, and some international patients; hospitals said their own clinical systems were not breached and patient care was not disrupted.
Hospitals disclosed that the stolen information included personal details and, in some cases, highly sensitive medical and financial data such as diagnoses, treatment information, correspondence, and limited bank or payment details. Several affected institutions suspended data transfers to the provider, Heidelberg University Hospital filed a criminal complaint, and officials in Freiburg called for a full investigation, while some hospitals said they were considering legal action against Unimed. The attackers have not been identified and no group has publicly claimed responsibility.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Heidelberg University Hospital said it had filed a criminal complaint in response to the theft of patient data linked to the Unimed compromise. Other affected institutions said they were considering legal action and called for a full investigation.
Hospitals stated that their own medical systems were not compromised and patient care was not disrupted by the Unimed incident. Some also said they had stopped transferring data to the provider after learning of the breach.
By 2026-05-21, multiple hospitals including Cologne, Freiburg, Heidelberg, Ulm, Tübingen and Mannheim disclosed that patient and billing data had been stolen through the Unimed breach. Reported exposed information included personal details and, in some cases, diagnosis, treatment, communications, and limited bank or payment data.
In mid-April 2026, attackers compromised Unimed, a third-party billing and administrative service provider used by multiple German hospitals. The intrusion affected data held by the provider rather than hospitals' own clinical systems.
After the April 14 compromise, Unimed said it stopped further attacker activity before encryption occurred, disconnected customer data interfaces, notified authorities and police, and engaged external forensic experts to investigate the incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcetagesschau.de
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Unlimited Technology Systems, a Montgomery, Ohio-based provider of revenue cycle management services, disclosed a data breach affecting **3,803,750 individuals** after hackers stole information from one of its commercial data centers. The intrusion occurred between **October 10 and October 15, 2025**, and was discovered on **October 19, 2025**. The company later reported the incident to the US Department of Health and Human Services in late July 2026, and HHS added it to its breach portal. The stolen data included personal, medical, and health insurance information such as **Social Security numbers**, medical record numbers, diagnoses, dates of service, insurance details, and scanned identity documents. Unlimited Technology Systems said full patient medical records, medical imaging, and financial account or payment card data were not exposed, and it has not identified attempted or actual misuse of the stolen information. The company is offering affected individuals two years of credit monitoring, fraud consultation, and identity theft restoration services.
Aug 10, 2026
Several U.S. healthcare organizations have disclosed significant data breaches involving unauthorized access to patient and employee information. MedStar Health reported that an unauthorized third party accessed internal systems containing sensitive patient data, including names, dates of birth, Social Security numbers, and medical information. The Rhysida threat group claimed responsibility for this attack, alleging the exfiltration and leak of over 7 million pieces of patient data. Brevard Skin and Cancer Center also confirmed a cyberattack in which the Pear threat group claimed to have stolen 1.8 terabytes of data, affecting both patient and employee records with information such as Social Security numbers, health conditions, and billing details. Both organizations have offered complimentary credit monitoring and identity theft protection to affected individuals and are reviewing their cybersecurity measures. Henry Ford Health in Michigan disclosed an insider data breach affecting nearly 2,000 patients, resulting in the termination of the responsible employee and notification to those impacted. While details on the specific data accessed were not provided, credit monitoring services have been offered. These incidents highlight the ongoing risks faced by healthcare providers from both external threat actors and insider threats, emphasizing the need for robust security policies and continuous evaluation of protective measures to safeguard sensitive health information.
Jun 29, 2026