CASE FILE #05: Unimed – Patient Data in the Wrong Hands

Why Third-Party Risk Management Must Start with the Data

The hospital IT systems were not hacked. Patient care was not disrupted. Yet highly sensitive patient data was stolen.

The April 2026 cyberattack on Unimed, a third-party medical billing service provider, highlights a key challenge in interconnected IT environments: An organization’s data can be compromised even when its own IT systems remain untouched.

1. What Happened?

In mid-April 2026, unknown attackers targeted the systems of Unimed, an external medical billing service provider for hospitals.

The provider processes billing information for numerous hospitals. As a result, its systems contained personal and, in some cases, medical information from multiple healthcare institutions.

More than 72,000 patients in total were affected across the University Hospitals of Freiburg, Heidelberg, Tübingen, and Ulm alone.

2. How Did It Happen?

The key issue lies in the data processing supply chain.

The attackers did not need to compromise the IT systems of each individual hospital. Instead, they targeted a central service provider where data from multiple institutions was processed.

According to the information released, the clinical systems of the affected university hospitals were not themselves targeted in the attack.

3. What Data Was Affected?

The information affected varied by hospital and patient.

In Freiburg, for example, basic personal information such as names, dates of birth, and addresses was stolen for approximately 54,000 individuals.

For around 900 people, billing information was also affected, potentially allowing conclusions to be drawn about diagnoses or treatments. In a small number of cases, bank details were also involved.

4. What Consequences and Risks Arise?

Health data is among the most sensitive categories of personal information.

Unlike a password, a diagnosis cannot simply be changed after a data breach.

Medical information combined with basic personal data can be used for targeted phishing, social engineering, or other forms of misuse. An attack on a service provider can also disrupt operational processes.

5. Which Traditional Security Measures Are Necessary?

Third-Party Risk Management requires contractual safeguards, security requirements, audits, certifications, and regular risk assessments.

Organizations should also evaluate which data a service provider receives, how long it retains that data, and which individuals or systems can access it.

Incident response processes and clearly defined responsibilities between the contracting organization and the service provider are also essential.

6. Why Are These Measures Alone Not Enough?

A contract cannot prevent a successful cyberattack.

Audits and certifications also cannot guarantee that a service provider will never be compromised.

Organizations must therefore ask an additional question: If a service provider were successfully attacked, which of our sensitive data would actually be accessible in plaintext?

7. How Does Data-Centric Security Help?

Data-Centric Security extends Third-Party Risk Management by adding protection directly at the data level.

Where business processes allow, sensitive data can be encrypted, tokenized, pseudonymized, or masked before it is handed over to an external service provider.

This makes it possible to outsource processing without necessarily relinquishing control over the data.

8. How Could eperi sEcure Have Protected the Data?

eperi sEcure can encrypt or tokenize sensitive information within supported data flows before it is transferred to external applications or systems.

Organizations can selectively define which data fields should be protected.

Cryptographic keys can remain under the control of the responsible organization rather than being held by the service provider alongside the protected information.

9. What Is the Key Lesson from the Incident?

Outsourcing shifts business processes—and often sensitive data along with them—to a third party’s infrastructure.

Third-Party Risk Management should therefore assess not only whether a service provider is trustworthy and secure, but also how heavily the protection of an organization’s own data depends on that provider’s security.

The lesson from CASE FILE #05: Outsourcing a process does not have to mean outsourcing control over the data.

The eperi Lesson: Assume Breach. Protect the Data.