- Hackers attacked the Charité webpage server and stole confidential information, including the names and emails of users & staff.
- Charité says patient information is safe and has filed a police report while notifying affected users.
- The hospital says the attack is not linked to the earlier PHP flaw; that vulnerability was caused by a precautionary website shutdown.
Hackers broke into a web server at Charité University Hospital in Berlin. They stole names and email addresses of staff, students, and outside contacts. The hospital says no health data was affected. Charité has filed a criminal complaint.
The hackers attacked the server hosting the website of the hospital. Some of the stolen information includes names, email addresses, and data about the organization. Also, the report notes that the hackers took the usernames of the hospital employees during the attack. The hospital has not reported the number of affected people.
What the Stolen Data Includes
The stolen records do not contain confidential health information but rather basic contact details. The data elements include first and last names of people, their email addresses, and sometimes the names of their companies. Reports also say the attackers accessed staff usernames Charité says it has found no sign that the data has appeared online or been misused.
One part of the leak needs extra care. People who used the online contact form of the hospital may have typed medical details into a free-text box. The hospital will write to those users directly. A name and email alone help a scammer little. A fake message that mentions a real appointment is far more convincing.
Charité has not said how many records the attacker copied. It has also not said whether the thief took the whole database or only part of it. Those answers will come as the investigation moves forward.
The Scale of the Leak Becomes Clearer
Charité now puts the number of affected people at roughly 140,000. About 46,000 of them are employees and students. Moreover, there are another 1,500 records available on the newsletters and press release lists of the hospital. However, close to 90,000 users, representing the biggest share, entered through the contact form on the website.
These figures show where the real exposure sits. Most victims never worked at the hospital. They simply asked a question through a public web page. That makes the group hard to warn one by one, and it stretches the notification work of the hospital over many weeks.
Charité stresses one point again. Sensitive health data under data protection law is explicitly not part of this leak. The hospital has also filed a criminal complaint and continues to work with the authorities.
How the Hospital Responded
Charité isolated the affected servers and took them offline as soon as he learned of the attack. The website of the hospital was temporarily unavailable on October 27. A spokesperson says their IT team has discovered and patched the access route the attached utilized.
Further, the hospital has increased its security measures. It is also in contact with supervisory and investigating authorities. Charité plans to notify every affected person individually.
The hospital warns people to be careful about unexpected contact from strangers. It says the stolen names and email addresses could make fake messages look more believable. Charité says it will not call people to ask for passwords.
Patients and staff should treat any unexpected email with care. They must check the sender for authenticity prior to clicking any link. Also, they must not download attachments if the email came from a suspicious entity. Should anybody have reason to believe that an email is fake, they have to contact the IT department of the hospital.
The hospital has informed the Berlin data protection commissioner. German law requires organizations to report certain breaches within 72 hours. Charité has not said whether it met that deadline. It has confirmed that it notified the relevant authorities.
Not Linked to Earlier PHP Flaw
The attack has no connection to a critical security flaw in PHP, a programming language. Charité had taken its website offline as a precaution the week before because of that flaw. That PHP issue affected institutions across Germany and Europe. Many organizations shut down websites while they applied security updates. Charité says the two events are separate.
PHP has also warned developers about another potential remote code execution (RCE) vulnerability and recommended disabling upload progress to reduce the risk.
The hospital has not said how the attackers got in. It has also not named a suspect or given a motive. Hospitals have become frequent targets for cyberattacks – this is because they hold sensitive records & depend on working systems. A disruption can delay care and put patients at risk. Charité has faced attacks before, and it has invested in security since then.
The current case appears limited to contact data. That keeps the harm lower than a full medical records breach. However, it is a good example of how even the smallest mistakes can lead to data exposure. Hospitals need to keep an eye on all systems that have any sort of data about their patients.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Apple iOS 27 Child Safety Features Spark Unverified Surveillance Claims in Australia
Social media posts say Apple and Google now spy on private messages, video calls and photos in Austr...
Lazarus Group Targets South Korea in New Spy Campaign Using Post-Quantum Encryption
Kaspersky links a new spy campaign called Operation FlashHole to North Korea’s Lazarus Group. ...
Signal, Windscribe Threaten Exit Over Canada’s Six-Month Metadata Rules
Bill C-22 of Canada demands that telecoms and messaging applications retain the metadata of all of t...
Hacker Claims Nearly 208,000 OpenRouter API Keys Are for Sale
A malicious individual has announced he is selling an OpenRouter database containing nearly 250,000 ...
Thousands of Websites Used to Deliver Coruna and DarkSword iPhone Spyware
Researchers found a campaign called DeadTag that abuses abandoned ad and analytics domains to send v...
PHP Warns of New Potential RCE Flaw, Recommends Disabling Upload Progress
PHP has disclosed CVE-2026-115560, a possible remote code execution flaw that affects apps with an u...
