Data breach: Medical practice, Switzerland 2022
Hackers stole data from two medical practices in Neuchâtel and posted it on the darknet; at the beginning of April 2022, «Le Temps» was able to search through data of more than 40'000 patients.
- Incident · 04.2022 · Neuchâtel NE, Switzerland
- Evidence: confirmed by an authority
- Data breach
As of
What happened
Personal details and health data such as medical histories and treatments were affected, which apparently were neither encrypted nor password-protected. The Neuchâtel police confirmed the incident, and the FDPIC demanded comprehensive information for the patients.
- Affected
- Company (anonymous)
- Industry
- Medical practice
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- data of more than 40'000 patients including health data
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Proceedings before authorities
Costs of FDPIC or GDPR proceedings, usually not fines
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Even a single practice must store health data in encrypted form; in an emergency, the FDPIC requires comprehensive information for those affected.
Sources
- Update: EDÖB informiert über Datenleck in Westschweizer Arztpraxen (opens in a new window) Netzwoche · 04.04.2022
«Er erwarte, dass die vom Datenleck betroffenen Patientinnen und Patienten umfassend von den Artzpraxen informiert werden.»