Ransomware (extortion): Medical practice, Switzerland 2026
At the beginning of November 2026, it became known that attackers had stolen data from the local data storage of the Gleis D centre in Chur and the affiliated Medi Porta: names, addresses, prescriptions, X-ray images and data of employees.
- Incident · 11.2026 · Chur GR, Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Data breach
As of
What happened
The ransomware group Cloak claims to have stolen 87 gigabytes; the electronic patient records were stored separately and remained untouched, and care continued. The centre filed a criminal complaint, reported the case to the NCSC and the FDPIC and warned patients of fraud attempts.
- Affected
- Gleis D medical centre and Medi Porta
- Industry
- Medical practice
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- Names, addresses, prescriptions, X-ray images of patients as well as employee data; according to the perpetrators 87 GB
- Bankruptcy
- no
- Entry point
- Attack on the local data storage
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Separately kept patient records save the treatment, but not the documents on the local storage.
Sources
- Cyberangriff auf Bündner Gesundheitszentrum (opens in a new window) inside-it.ch · 06.11.2026
«ein Abfluss sensibler Patienten- und Mitarbeiterdaten liess sich jedoch nicht vollständig verhindern»
- Cyberangriff in Chur: Rezepte und Röntgenbilder gestohlen (opens in a new window) Medinside · 06.11.2026
«Auf die medizinische Versorgung hatte die Attacke laut den Betreibern keine Auswirkungen.»