unimed (German medical billing service provider): failed encryption attempt, billing-dispute data stolen affecting many hospitals’ patients

What happened

• unimed detected the attack on 14 Apr 2026; attackers tried and failed to encrypt systems but took data from a limited area, including billing-dispute correspondence handled for private patients and self-payers on behalf of clients (Konbriefing: numerous hospitals). unimed says most data is not especially sensitive and has seen no publication.
• Root cause / initial access: not disclosed.
• Attacker: not identified.
• Response: client data interfaces separated, police and DPA notified, forensics, external SOC; per-client analysis delivered from mid-May.

Sources

• https://www.unimed.de/presse/
• https://konbriefing.com/en-topics/cyber-attacks.html

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.