Large-Scale Patient Data Breach Hits German University Hospitals via Billing Provider German university hospitals are responding to a major patient data breach after hackers targeted Unimed, an external billing service provider used by medical centers nationwide. The attack, which occurred in mid-April, exposed sensitive information from thousands of patients across multiple institutions, though clinical systems and patient care remained unaffected. The breach impacted hospitals in Cologne, Freiburg, Heidelberg, Tübingen, Ulm, and Mannheim, with varying degrees of exposure. University Hospital Cologne reported nearly 30,000 affected individuals, including 840 cases where health-related communications with the billing provider were compromised. In five instances, bank and payment data was also accessed. Freiburg University Hospital disclosed that 54,000 patients had basic personal data stolen, with 900 cases involving billing details tied to diagnoses or treatments. Heidelberg University Hospital identified 11,000 affected patients, including 2,700 with exposed billing records, while Ulm University Hospital reported 1,600 impacted individuals, with 300 cases involving treatment information. Unimed processes invoices and administrative data for privately insured, self-paying, and some international patients, meaning those under Germany’s statutory public health insurance were largely unaffected. The hospitals have suspended data transfers to the provider, which has not publicly commented on the incident. No ransomware group or threat actor has claimed responsibility, and the method of attack remains undisclosed. Several hospitals, including Heidelberg, have filed criminal complaints against unknown perpetrators, while others are exploring legal action against Unimed. Freiburg University Hospital’s medical director, Frederik Wenz, emphasized the severity of the breach, stating, “Health data is among the most sensitive data of all. Its theft is a serious infringement on the rights of those affected.” The hospitals are demanding a full investigation from the service provider.