Deception (social engineering): Hospital and care home, Switzerland 2026
On 8 September 2026, the CHUV reported that a cyber incident at an external laboratory for cancer diagnostics had brought data of eleven of its patients onto the darknet: names, dates of birth, health insurer and treating specialists.
- Incident · 09.2026 · Lausanne VD, Switzerland
- Evidence: confirmed by an authority
- Deception (social engineering)
- Data breach
- Attack via a supplier
As of
What happened
According to initial findings, the perpetrators exploited a human error at the service provider by means of vishing. The CHUV’s own systems were not affected; the hospital suspended the collaboration as a precaution and informed those affected and the authorities.
- Affected
- CHUV (Centre hospitalier universitaire vaudois)
- Industry
- Hospital and care home
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- 11 patients (name, date of birth, health insurer, specialist); no health data
- Bankruptcy
- no
- Entry point
- Vishing (phone phishing) at an external laboratory
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
A single call to the laboratory can cost patient data; service providers handling health data need clear rules for enquiries over the phone.
Sources
- Cyberincident chez un prestataire externe (opens in a new window) CHUV · 08.09.2026
«aucune donnée de santé n’a été divulguée»