Charité confirms data leak after attack on web server
Contact details of employees, students and external persons were stolen. According to the clinic, patient care continues without disruption.
A cyberattack on a web server at Berlin's Charité has leaked personal contact data. Those affected include employees, students and external persons who had used the contact form to get in touch with the university hospital, for example to request an appointment. The clinic confirmed the incident on 30 October. According to its account, patient care was not and is not affected.
Charité announced that it would inform every affected person individually. It said it had analysed the cause, strengthened its protective measures and was in close contact with supervisory and investigating authorities. Who was behind the attack and how the access technically succeeded does not emerge from this public statement.
A contact form can hold more than an address
The term contact data sounds like limited damage. At a hospital, however, the reason for making contact is also relevant. According to the Medinside report of 2 November, people were able to describe medical problems in the form's free-text field. Whether and which such content actually leaked is not broken down in detail by Charité's brief public statement.
Citing the «Deutsches Ärzteblatt», the specialist outlet puts the total at around 140,000 affected persons: some 46,000 employees and students, 1,500 contacts on press and newsletter distribution lists, and 90,000 users of the contact form. Charité itself does not give a total figure in its published statement. The rounded order of magnitude from the media report must therefore be distinguished from a complete, publicly verifiable list.
Undisturbed clinical operations also answers a different question than the protection of personal data. The clinic can keep treating patients while a data leak still endangers those affected. The statement about operations does not amount to an all-clear for the confidentiality of the stolen information.
The previously reported PHP vulnerability is a separate matter
Charité explicitly distinguishes the attack from a PHP security vulnerability. Because of that vulnerability, it had already taken its website offline temporarily as a precaution the previous week. There is no connection with the data leak now confirmed, the clinic says.
The earlier shutdown is therefore not a proven explanation for the latest attack. Nor does the public statement allow any conclusion about encrypted clinical systems or failed medical devices. What is confirmed is an attack on the web server, which also hosts the website.
For a hospital these are separate tasks: securing clinical operations, determining the scope of leaked data and informing those affected. Which technical countermeasures sufficed in the specific case cannot yet be assessed from a general statement about strengthened safeguards.
In Switzerland there are two different reporting channels
Swiss institutions that fall under the reporting obligation for critical infrastructure must report relevant cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. The rule has applied since 1 April 2025. If details are still missing in the initial report, they can be completed within 14 days.
An operational standstill is not a prerequisite for the reporting obligation. BACS explicitly also names attacks that cause information to leak or be manipulated, as well as extortion, threats or coercion. A data leak can therefore be relevant even though care continues. Whether a particular institution falls under the obligation depends on the Information Security Act and the exceptions in the Cybersecurity Ordinance.
Alongside this sits the data protection notification. Under Swiss data protection law, controllers must report a data security breach to the Federal Data Protection and Information Commissioner as quickly as possible if a high risk to the personality or fundamental rights of those affected is likely to arise. A report to BACS does not replace this assessment.
The competent data protection supervisory authority is not the same for hospitals everywhere. The FDPIC notes that federal law applies to the medical records of private clinics, while the respective cantonal data protection law applies to those of hospitals with a cantonal service mandate. A single reporting address for all Swiss hospitals would therefore be misleading.
Those affected need concrete information
For people whose data has leaked, what matters in particular is which information is affected and which protective steps are needed. Within the scope of federal data protection law, controllers must inform them if this is necessary for their protection or if the supervisory authority requires it. Charité has announced individual notification. This must now make the general statements about the web server incident concrete for each affected person.
Sources
- Charité: statement on the web server attack, 30 October 2026
- BACS: reporting obligation for critical infrastructure
- BACS: which attacks must be reported
- BACS: scope of the reporting obligation
- FDPIC: reporting of data security breaches
- FDPIC: data protection questions on medical records and hospitals
- Medinside: data leak at Charité, 2 November 2026
- Title image: Vysotsky, editing Lear 21, Charité 2022, Wikimedia Commons
- Title image licence: CC BY-SA 4.0
- Article image: Derrick Coetzee, servers at NERSC, Wikimedia Commons
- Article image licence: CC0 1.0
