Prescriptions and X-rays stolen from Chur health centres
Gleis d and Medi Porta confirm the leak of patient and staff data. Anyone who has not received a personal message may still be affected.
Personal and medical data have been stolen from the Medizinisches Zentrum gleis d and its affiliated Medi Porta in Chur. According to the operators, this includes names, addresses, prescriptions and X-ray images. Data from employees has also leaked, they say. The institutions confirmed the incident in a statement dated 2 November 2026; the specialist outlet Inside IT reported on it on 6 November.
Medical care remains fully guaranteed, the centres explain. The attack affected neither diagnosis nor treatment. For patients, however, ongoing operations are no all-clear on data protection: information already stolen can be reused outside the institution.
Local storage rather than the separate patient record
The operators narrow down the affected systems. The targets were local data storage locations. The electronic patient record is kept in a separate application and is not affected. The statement therefore refers to one specific system. It does not mean that no medical records were stolen: the same statement explicitly names prescriptions and X-ray images as leaked data.
Together with the IT partner and external cyber specialists, they stopped the attack, secured the systems and closed identified security gaps. Despite the short response time, the data leak could not be fully prevented. Further investigations are ongoing; the IT partner is working with external experts to determine whether additional changes to the security systems are needed.
When the attackers first gained entry, which specific vulnerability they exploited and how many people are affected is not stated in the statement. A date for the attack itself therefore cannot be derived from the publication date.
No personal message is no all-clear
In a supplementary patient information notice, the centres answer an obvious question: anyone who has not yet been informed personally may still be affected. The institutions point to their public communication through various channels. Former patients are also reached via the media release. A completed personal notification of all affected persons is not confirmed in it.
The centres say they are in direct contact with the affected employees. For individual questions they name a joint contact point on telephone number 081 287 70 90. Anyone who wants to clarify whether their own records are affected can get in touch there. A reliable list of all stolen data records is not publicly available.
Fraudsters could use genuine details
The centres warn about messages and calls that fake their sender identity. Names and addresses can help make an invented story credible. As a further possible consequence, the operators name identity misuse, for example orders placed under someone else's name. These are risks of the data leak, not confirmation of fraud that has already occurred.
In their published answers, the institutions instead state that they have no information about fraud attempts in their name. At the same time they stress that they do not ask for passwords, bank details or payments by e-mail, SMS or telephone. Anyone who receives such a request should not reply and should report the matter to the centres.
Those affected should also check invoices and payment reminders: is the sender known, was the service actually used and are the payment details correct? According to the warnings, a displayed telephone number alone offers no security because it can be forged.
The claimed 87 gigabytes remain an attacker's claim
According to Inside IT, the ransomware group Cloak has claimed responsibility. The group claims on the darknet to have captured 87 gigabytes of data, including identity and financial documents. These figures on volume and content are not independently confirmed. Whether a ransom demand exists is something the centre declined to answer to the specialist outlet.
According to their own statements, the operators have filed a criminal complaint and informed the Federal Office for Cybersecurity and the Federal Data Protection and Information Commissioner. A confirmation from these bodies is not contained in the published documents.
According to the supplementary information, patients can request information about their data. The centres must retain medical records for the statutory periods; beyond that, deletion requests would be assessed under applicable law. Anyone changing treating institution can have their records handed over to themselves or to the new doctor.
Sources
- Gleis d and Medi Porta: media release of 2 November 2026
- Gleis d and Medi Porta: information and support for those affected
- Gleis d: current notice on the cyber incident
- Inside IT: cyber attack on Graubünden health centre, 6 November 2026
- Medinside: report on the data leak in Chur, 6 November 2026
- Title image: Daniel Sone / National Cancer Institute, public domain
- Article image: Victorgrigas, servers of the Wikimedia Foundation
- Licence for article image: CC BY-SA 3.0
