German University Hospitals Report Patient Data Breach via Billing Provider

Patient names, addresses, medical billing records and in some cases full bank details from six major German university hospitals were stolen from their shared billing provider Unimed during a cyber attack in mid-April 2026.

Public reporting indicates the compromised organizations include University Hospitals in Cologne, Freiburg, Heidelberg, Tübingen, Ulm and Mannheim. The breach occurred at Unimed, a third-party service handling billing and administrative functions, not at the hospitals’ clinical networks. Data exposed includes patient names, residential addresses, treating physician information, health-related communications and, for some individuals, direct banking or payment details. The hospitals began notifying affected patients in late May after completing their internal investigations. Available reporting describes the incident as a ransomware or data-theft attack targeting the billing vendor, though full technical details remain limited.