Breaches and incidentsBriefReported by a reputable outlet, citing the company
HelloBetter (German digital therapeutics, DiGA for depression and anxiety): internet-exposed BI system breached, therapy data stolen
Attackers reached HelloBetter’s business intelligence system and associated database on the evening of 6 Sep 2026.
- Disclosed
What happened
- Attackers reached HelloBetter’s business intelligence system and associated database on the evening of 6 Sep 2026; it was noticed and shut down the next morning, after “data of a significant extent” was stolen: emails, names, dates of birth, insurance numbers, questionnaire answers, programme progress, possibly diary free text and support requests (heise). Much is pseudonymised or encrypted, but HelloBetter cannot rule out identification. Use of its six DiGA can imply a mental-health diagnosis. Count not stated.
- Root cause: an open-source data-analysis (BI) tool that appears to have been reachable from the internet; the vulnerability was not disclosed. The attackers may have created accounts.
- Attacker: unknown.
- Response: access restricted to internal, rogue accounts removed, all credentials and encryption keys rotated, BSI and Hamburg DPA notified, users notified under Art. 34 GDPR.
Sources
- https://www.heise.de/en/news/Digital-health-applications-HelloBetter-reports-data-breach-after-cyberattack-11469420.html
- https://konbriefing.com/en-topics/cyber-attacks.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.