Attackers stole personal and medical data from two health centres in Chur, Switzerland: the Medizinisches Zentrum gleis d and its affiliated practice, Medi Porta. In a statement dated 2 November 2026, the operators confirmed that names, addresses, prescriptions and X-ray images were taken, along with data on staff. The Swiss IT outlet Inside IT first reported the breach on 6 November. It says the ransomware group Cloak has claimed the attack on its dark web site and says it took 87 GB of data. Nobody has independently confirmed that figure, and the centres have not said how many patients are affected.
What Happened
The operators say the attack hit local data storage at the two centres. Their electronic patient record runs in a separate application, and they say it was not touched. Working with their IT provider and outside security specialists, they say they stopped the attack, secured the affected systems and closed the security gaps they found.
The centres say patient care was not disrupted at any point. Diagnosis and treatment carried on, and both sites are still fully open. They have filed a criminal complaint and reported the incident to the Federal Office for Cyber Security (BACS) and the Federal Data Protection and Information Commissioner (FDPIC/EDÖB). They describe further security investigations as ongoing.
Medinside and JournalPlus both carried the story after Inside IT. Their accounts match on every fact the operators have confirmed. Neither outlet has given a figure for affected patients or employees. It is also not known whether the attackers demanded a ransom: the centres did not answer Inside IT's question on that point.
What Was Taken
Confirmed by the operators: - Patient names and addresses - Prescriptions - X-ray images - Employee data (the operators have not said which categories)
Claimed by Cloak, unconfirmed: - About 87 GB of data in total - Identity documents - Financial records - Other medical information
The operators stress that the electronic patient record was not affected, but that does not mean no medical data left the building. As JournalPlus points out, the same statement names prescriptions and X-rays among the stolen data. Those records were apparently kept on the local storage that was breached, outside the protected record system.
JournalPlus also reports a warning that patients who have not received a personal notification may still be affected. Notification does not appear to be complete, so nobody should take silence as a sign that their data is safe.
Why It Matters
The breach follows a familiar pattern for smaller healthcare providers. The core clinical system is kept separate and well protected. Meanwhile file shares, imaging exports, scanned prescriptions and admin folders build up on local storage that gets far less attention. This is the material extortion groups go after, because health and identity data stays sensitive for years.
Recent incidents around the world look similar: - NorthShore Health Centers (Indiana): the Insomnia group claimed the attack and then leaked the data. The HIPAA Journal reports that the file tree suggests patient records were included. - Epichealth (Victoria, Australia): The Gentlemen listed the medical group on 31 October and threatened to publish its data. - ZenTech (New Zealand): Health New Zealand's clinical trials contractor lost up to 67.1 GB to a ransomware attack. NZ Lawyer reports that the data appeared on a leak site, was taken down, briefly came back, and that the High Court granted an interim injunction over it.
New Zealand's Privacy Commissioner, in its report on the Manage My Health portal breach, also flagged how long information was kept and how good the breach communications were. Both questions apply here too.
The most immediate risk for patients in Chur is fraud. The operators and the press coverage both warn that names, addresses and real treatment details could make phishing calls, emails or letters convincing, for example messages claiming to come from the practice, a health insurer or a pharmacy.
The Attack Technique
The operators have not said how the attackers got in, and Cloak has not published any technical details. Neither the operators nor any outlet has named an entry point, an exploited vulnerability or a timeline for how long the attackers were inside. The confirmed facts are limited to three: - local storage was the target; - data was taken out; - the operators say they found and closed "security gaps".
Whether files were also encrypted has not been said. Patient care continuing without interruption suggests either no encryption or limited impact on clinical systems, but that is an inference and has not been confirmed.
Defenders should still keep the usual ransomware entry points against healthcare in view: exposed remote access, VPN appliances without MFA, stolen credentials, and unpatched on-premises servers. For example, Kaspersky's Securelist recently described a fileless intrusion by Storm-2603 that used the ToolShell SharePoint flaws (CVE-2025-53770 and CVE-2025-53771). In that case the attackers ran in memory inside the IIS worker process before trying to deploy ransomware. There is no evidence linking that activity to the Chur breach. It is mentioned only as an example of on-premises infrastructure being turned into an entry point.
What Organizations Should Do
- Map and lock down local data stores. Find where imaging exports, scanned prescriptions and patient correspondence sit outside the core record system. Then delete what you don't need, restrict access to what remains, and encrypt it at rest.
- Watch for large outbound transfers. 87 GB leaving a small practice should stand out. Alert on unusual outbound volume, unfamiliar cloud storage destinations, and archiving tools running on file servers.
- Harden remote access. Require phishing-resistant MFA on VPN, RDP and remote support tools, including the accounts used by outside IT providers, and patch internet-facing appliances and on-premises servers quickly.
- Set clear duties for IT providers. Small clinics depend on outsourced IT. Contracts should cover logging, how long logs are kept, incident response times, and who is responsible for patching shared systems.
- Prepare patient communications in advance. Have a fraud warning ready that tells patients exactly how the practice will and won't contact them. Notify affected patients and staff one by one, and quickly.
- Plan for leaks, not just encryption. Practise a scenario where operations keep running but data is published. Decide in advance how you will handle regulator reports, legal options such as the injunction Health New Zealand obtained, and checks for re-shared data.
Sources: Prescriptions and X-rays stolen from Chur health centres | How to detect fileless attacks exploiting ToolShell: analyzing the... | Data Breach Announced by NorthShore Health Centers | Exclusive: Epichealth Medical Clinics confirms ransomware-related d... | Cyberangriff in Chur: Rezepte und Röntgenbilder gestohlen | 🔒 Cyberangriff in Chur: Rezepte und Röntgenbilder gestohlen - Medin... | Office of the Privacy Commissioner Manage My Health phase two report | High Court grants injunction over data taken in ZenTech cyber attac...