Germany
DEU
Unimed billing provider breach exposes German hospital patient data (Apr 2026)
Billing provider Unimed suffered a cyberattack on 14 April 2026 with data exfiltration affecting patients of multiple German university hospitals; University Hospital Cologne reported 27,298 individuals with general data affected (843 with health data; 5 with bank/payment data), and Düsseldorf confirmed impact via Unimed as a former contractor; Unimed published an update supporting coordinated patient notifications (https://www.uniklinik-duesseldorf.de/ueber-uns/pressemitteilungen/detail/cyberkriminelle-entwenden-patientendaten-bei-ehemaligem-externem-abrechnungs-dienstleister-des-ukd,https://www.uk-koeln.de/uniklinik-koeln/presse/pressemitteilungen/details/cyberkriminelle-entwenden-patientendaten-bei-externem-abrechnungs-dienstleister/,https://www.unimed.de/presse,https://www.tagesschau.de/inland/gesellschaft/cyberangriff-kliniken-100.html).
60
Estimated severity
60 / 100
92
Source reliability
92 / 100
Approximate Date
14/04/2026
Targeted Company
UNIMED
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
UNIVERSITATSKLINIKUM KOLN (Downstream customer)UNIVERSITATSKLINIKUM DUSSELDORF (Downstream customer)UNIVERSITATSKLINIKUM FREIBURG (Downstream customer)UNIVERSITATSKLINIKUM HEIDELBERG (Downstream customer)
Geographic Impact
Country Targeted Company
Other Affected Countries
No other affected countries reported
Target country
Germany
Affected countries
Germany
Impacted regions
No information
Operational Impact
Duration
No information
Financial impact (USD M)
No information
Impact types
No information
Affected sectors
Healthcare & Public Health
Affected departments
No information
Attack Profile
Attack types
Data breachData exfiltrationUnauthorized accessThird-party or partner compromise
Attributed threat actors
No information
Sources
Incident Sources
unimed.dehttps://www.unimed.de/presseuk-koeln.dehttps://www.uk-koeln.de/uniklinik-koeln/presse/pressemitteilungen/details/cyberkriminelle-entwenden-patientendaten-bei-externem-abrechnungs-dienstleister/uniklinik-duesseldorf.dehttps://www.uniklinik-duesseldorf.de/ueber-uns/pressemitteilungen/detail/cyberkriminelle-entwenden-patientendaten-bei-ehemaligem-externem-abrechnungs-dienstleister-des-ukdtagesschau.dehttps://www.tagesschau.de/inland/gesellschaft/cyberangriff-kliniken-100.htmlwww1.wdr.dehttps://www1.wdr.de/nrw/koeln/cyberangriff-krankenhaus-daten-patienten-100.htmltherecord.mediahttps://therecord.media/hackers-steal-patient-billing-data-german-hospitalsuniklinik-freiburg.dehttps://www.uniklinik-freiburg.de/presse/pressemitteilungen/detailansicht/6807-cyberangriff-auf-externen-dienstleister-betrifft-auch-daten-von-patientinnen-des-universitaetsklinikums-freiburg.htmlklinikum.uni-heidelberg.dehttps://www.klinikum.uni-heidelberg.de/newsroom/cyberangriff-auf-externen-dienstleister-betrifft-auch-daten-von-patienten-des-universitaetsklinikums-heidelberg/