Full Report
Bei einem Cyberangriff auf einen externen Dienstleister haben Kriminelle Daten von Zehntausenden Patientinnen und Patienten von Kliniken in Baden-Württemberg gestohlen. Es geht zum großen Teil um Informationen wie Namen und Adressen, aber auch um Rechnungsdaten, wie die Unikliniken Freiburg und Ulm am Donnerstag mitteilten. Im Fall der Uniklinik Freiburg stahlen die Diebe sogenannte Stammdaten wie Name, Geburtsdatum und Adresse - von rund 54.000 Menschen. In 900 Fällen flossen zusätzlich Rechnungsdaten ab. Diese können Aufschluss geben über "Diagnose und Behandlungsart" der Patientinnen und Patienten, wie die Uniklinik weiter mitteilte. In sehr wenigen Fällen sind demnach auch Kontodaten betroffen. (via Valéry Rieß-Marchive)
Analysis Summary
# Incident Report: Supply Chain Cyberattack on Unimed (Medical Billing Provider)
## Executive Summary
A major cyberattack targeted **Unimed**, a third-party medical billing service provider, resulting in the theft of sensitive data belonging to tens of thousands of patients from multiple university hospitals in Baden-Württemberg. The breach primarily affected private patients and self-payers, exposing master data (names, addresses, birth dates) and, in thousands of cases, clinical diagnoses and treatment details.
## Incident Details
- **Discovery Date:** April 16, 2026 (Initial notification to BSI)
- **Incident Date:** Mid-April 2026
- **Affected Organization:** Unimed (Service Provider); Unikliniken Freiburg, Ulm, Mannheim, Heidelberg, and Tübingen (Clients).
- **Sector:** Healthcare / Supply Chain (Billing Services)
- **Geography:** Saarland and Baden-Württemberg, Germany
## Timeline of Events
### Initial Access
- **Date/Time:** Mid-April 2026
- **Vector:** Unspecified cyberattack on the external service provider Unimed.
- **Details:** Attackers compromised the infrastructure of Unimed, which handles billing for various university clinics.
### Lateral Movement
- **Details:** Not disclosed; however, the attackers gained sufficient access to extract billing-related databases containing patient records.
### Data Exfiltration/Impact
- **Uniklinik Freiburg:** ~54,000 patients affected. Data included names, birth dates, and addresses. 900 cases included medical invoice data (diagnoses/treatments). Limited cases of banking details.
- **Uniklinik Ulm:** ~1,600 patients affected; 300 included diagnostic data.
- **Uniklinik Mannheim:** ~3,000 patients affected; one case of financial data.
- **General Impact:** Overall scope estimated in the tens of thousands across all affected clinics.
### Detection & Response
- **April 16, 2026:** Regulatory authorities (Data Protection Authority) and the BSI were informed.
- **Mid-April 2026:** Uniklinik Freiburg immediately halted all data transfers to Unimed.
- **May 18, 2026:** Final scope of the data leak was confirmed.
- **May 21, 2026:** Public disclosure issued by the hospitals.
## Attack Methodology
- **Initial Access:** External compromise of a service provider (Supply Chain).
- **Exfiltration:** Systematic extraction of billing databases.
- **Impact:** Significant Data Breach involving PII (Personally Identifiable Information) and sensitive PHI (Protected Health Information).
## Impact Assessment
- **Financial:** Risk of fraud for those whose bank details were stolen; potential regulatory fines for the provider under GDPR.
- **Data Breach:** High-volume theft of PII and sensitive medical diagnoses/treatments.
- **Operational:** Disruption of billing processes as clinics suspended data transfers to the provider.
- **Reputational:** High public impact due to the sensitive nature of health data and the involvement of prominent university clinics.
## Indicators of Compromise
- **Network/File/Behavioral:** Specific technical IoCs were not disclosed in the public statement. Analysts should monitor for unauthorized access to medical billing portals or unusual FTP/API traffic toward Unimed infrastructures.
## Response Actions
- **Containment:** Suspension of data transmissions from the clinics to the service provider.
- **Compliance:** Notification of the Federal Office for Information Security (BSI) and Data Protection Authorities.
- **Communication:** Clinics established dedicated contact points (e.g., `G2.sammel.zentraleabrechnung[at]uniklinik-freiburg[.]de`) and initiated direct outreach to affected patients.
## Lessons Learned
- **Supply Chain Vulnerability:** The incident highlights that hospital security is only as strong as its weakest third-party vendor.
- **Delayed Visibility:** It took over a month (from mid-April to May 18) to determine the full extent of the data loss, suggesting a need for better logging and forensic readiness at the provider level.
## Recommendations
- **Vendor Risk Management:** Implement stricter security audits and "Right to Audit" clauses for third-party providers handling health data.
- **Data Minimization:** Ensure providers only receive the minimum data necessary for billing purposes.
- **Encryption:** Ensure data is encrypted at rest and in transit, with strict access controls to prevent bulk exfiltration.
- **Incident Response Planning:** Develop pre-defined communication templates for patient notification in the event of a breach to reduce the time between discovery and public disclosure.