Data breach at University Hospital Mainz exposes personal data of 2,764 patients

A cyberattack on an external billing service that processes private and self‑paying patients for the University Hospital Mainz (Universitätsmedizin Mainz) was discovered after the incident, which occurred in mid‑April. The breach affected a total of 2,764 patients. Basic personal information such as name, address and date of birth was compromised for 2,142 individuals, while health‑related data—including diagnoses and medical record content—was accessed for 621 patients, and financial data in one case.

The hospital confirmed that the clinical systems and patient care were not disrupted and that the attack was limited to the external provider located in Saarland. Only privately insured and self‑paying patients were affected; statutory‑insured patients were not impacted. Letters informing the affected individuals are being sent by early June to advise on possible risks and protective measures.