Your go-to hub for Expert Insights,
Publications, and Resources on
data privacy and compliance

One of Central Europe’s largest private healthcare providers, AMEOS Group, has disclosed a serious cybersecurity breach that may have compromised sensitive data belonging to patients, employees, and business partners.

The Zurich-based healthcare giant, which operates over 100 facilities—including hospitals, clinics, and nursing homes—across Germany, Austria, and Switzerland, revealed the incident through a public statement on its website. The move comes in compliance with Article 34 of the General Data Protection Regulation (GDPR), which requires organizations to inform the public in the event of a significant data breach.

With over 18,000 staff and more than 10,000 beds, AMEOS is a key player in the DACH healthcare landscape, reporting annual revenues exceeding $1.4 billion.

Despite having “extensive security measures” in place, the group confirmed that external attackers were able to infiltrate its IT systems. The breach may have given unauthorized access to a range of sensitive information—potentially including contact details and personal data from its vast network of patients, staff, and partners.

In its statement, AMEOS cautioned, “It cannot be ruled out that this data may be misused on the internet to the detriment of those affected or made accessible to third parties.”

As a precautionary step, the organization has shut down all IT systems and severed both internal and external network connections. AMEOS has also brought in external cybersecurity and forensic experts to assess and contain the incident.

The relevant data protection authorities across the affected countries have been notified, and a criminal complaint has been filed with local law enforcement agencies.

At this stage, there’s no evidence that the stolen data has surfaced online or is being actively misused. However, AMEOS has urged former and current patients to be alert for phishing emails and potential scams.

“Currently, we have no specific evidence of an actual leak of your individual personal data,” the company said. “You will be informed immediately upon completion of the ongoing review and investigation measures.”

Notably, no known ransomware groups have claimed responsibility for the attack, and AMEOS has not disclosed whether the incident involved data encryption—leaving both the nature of the breach and the perpetrators unknown.

With investigations still ongoing, AMEOS has pledged to provide timely updates as more details come to light.

As healthcare systems worldwide grow increasingly digital, this breach underscores the rising cybersecurity risks facing the sector—and the urgent need for robust, proactive defenses.

Stay with us for updates on: DPDP Consultants Newsletter