European healthcare provider AMEOS reports security breach

The AMEOS Group, an operator of a healthcare network in Central Europe, has disclosed that it has become the victim of a data protection incident.

The AMEOS Group is one of the most important healthcare providers in Austria, Germany, and Switzerland. According to its website, the healthcare company has over 100 facilities at 50 locations and employs over 18,000 people. In addition, AMEOS serves over 500,000 people every year, resulting in an annual revenue of $6 billion in 2024.

However, despite extensive security measures, hackers were able to access the healthcare provider’s IT system for a short period.

During the breach, data from patients, employees, and partners, as well as contact details about business partners, could have been affected. “It cannot be ruled out that this data is used to the disadvantage of the data subjects or made accessible to third parties,” the company says in a press release.

The healthcare provider continues by saying that all internal and external network connections were separated, and all systems were shut down. IT and forensic service providers were immediately involved. Existing safeguards have been checked and reinforced immediately.

The responsible data protection authority (DPA) has been informed about the incident. In addition, criminal charges have been filed with the responsible state criminal investigation office.

The AMEOS Group is warning affected patients, employees, and partners of potential scamming attempts, such as phishing and identity theft. Victims should therefore pay close attention to any unauthorized access to online accounts, dubious job offers, and other questionable messages in their inbox.

“At present, we have no specific information on an actual outflow of your individual personal data, and information will be provided immediately after the ongoing audit and investigation measures have been completed,” the healthcare provider concludes.

No details have been shared on when the incident took place, how the attackers got in, and if any ransom demands were made.

As of writing, no ransomware operations have claimed responsibility for the attack on the AMEOS Group.