Medizinisches Zentrum Gleis D, a medical centre in Chur, in the canton of Graubünden, and its pharmacy Medi Porta have been hit by a cyberattack, the Swiss IT news outlet Inside IT reported on 6 November 2026. Patient and employee data were leaked: names, addresses, prescriptions and X-rays. The ransomware group Cloak claims to have stolen 87 gigabytes (GB).

What the Chur medical centre confirms

The centre acknowledges a partial but real leak. According to its statement, quoted by Inside IT, the attack was stopped quickly together with its IT partner. However, the exfiltration of sensitive patient and employee data could not be entirely prevented.

The affected data were stored on local storage drives. The electronic patient record, kept in a separate application, was not compromised, according to the "Cybervorfall" notice published on the centre's website. Gleis D states there that it immediately took steps to close the security gaps it identified.

Care continues. The centre and Medi Porta remain fully operational, and the incident has had no effect on diagnoses or treatments, according to the statement relayed by Inside IT. Medi Porta combines a pharmacy and a medical practice on the ground floor of the centre, according to the Gleis D website.

The centre has filed a criminal complaint. It has also reported the incident to the Federal Office for Cybersecurity (FOCS) and to the Federal Data Protection and Information Commissioner (FDPIC). Its IT partners and external experts are continuing their analysis to determine whether further security measures are needed.

What the Cloak group claims

The volume stolen is known only from the hackers. On the darknet, Cloak claims to have taken 87 GB of data, according to Inside IT. The group says it also found identity documents and financial records. The centre has confirmed neither this volume nor these categories.

ItemStatusWho says so
Leak of names, addresses, prescriptions and X-raysConfirmedGleis D, quoted by Inside IT
Electronic patient record sparedStatedGleis D
Theft of 87 GB of dataClaimedCloak
Identity documents and financial recordsClaimedCloak
Ransom demandUnknownThe centre has not commented

The public claim is part of the method. The federal authorities describe a "double extortion", covered in our guide to ransomware in companies: the hackers copy the data, then encrypt it. If no payment is made by the deadline, they publish it on a darknet leak site, according to the joint press release of the Office of the Attorney General of Switzerland, the Federal Office of Police (fedpol) and the FOCS of 16 October 2025. The Gleis D statement makes no mention of its systems being encrypted.

The FOCS advises against paying a ransom. There is no guarantee that the criminals will then refrain from publishing the data, the office points out.

Health data leak: what the law says

This information is among the most protected under Swiss law. The Federal Act on Data Protection (FADP) classifies health data as "sensitive personal data" in its article 5. Our analysis: prescriptions and X-rays clearly fall into this category.

Article 24 of the FADP sets out the procedure after a leak. The controller must notify the FDPIC "as soon as possible" of a breach that is likely to result in a high risk for the data subjects. The notification must state at least the nature of the breach, its consequences and the measures taken or planned. The controller must also inform the data subjects when this is required for their protection, or when the Commissioner requests it.

The two federal contact points can talk to each other. Since 1 April 2025, the FDPIC can forward a notification to the FOCS for analysis, with the controller's consent, under paragraph 5bis of the same article.

The FOCS has its own reporting rules. Since 1 April 2025, operators of critical infrastructure have had to report a cyberattack to it within 24 hours of its detection, according to the Federal Council press release of 7 March 2025. Other organisations may do so voluntarily. Gleis D has not specified in what capacity it reported the attack.

Cyberattack in Switzerland: a string of data thefts

Gleis D adds to several data thefts in Switzerland this autumn. Holcim, the Zug-based building materials group, has confirmed a data theft, according to ICTjournal on 4 November 2026. In the cyberattack on Holcim, the ransomware group Emperador claimed 360 GB.

Public institutions and service providers are also being targeted. At the end of September 2026, data from the Zurich pension fund were stolen from an external software supplier. After the cyberattack in Vaud, announced on 31 October 2026, the canton reported the incident to the FOCS and to its data protection authority.

The official figures confirm sustained pressure. According to the FOCS press release of 24 August 2026, the number of ransomware attacks levelled off at 79 in the first half of 2026. The Federal Commissioner, Adrian Lobsiger, had received 455 notifications of data breaches in Switzerland since the start of 2026, compared with 343 for the whole of 2025. He said so on 25 October 2026.

What Gleis D patients can watch out for

The centre itself is warning its patients about possible fraud attempts, according to Inside IT. This risk has already materialised elsewhere. After the TCS Camping data leak, scammers used real booking information to appear credible. Some 15,000 customers had been warned about these WhatsApp messages, according to ICTjournal on 27 October 2026.

Our analysis: a call, a text message or an email that cites an exact address, a prescription or an examination does not prove that the sender is the centre. The guidelines given by the canton of Vaud to its users apply here:

  • never give out your password;
  • be wary of urgent or unusual messages;
  • report any suspicious message.

Individuals can report a cyber incident to the FOCS, which receives voluntary reports from the public. More cases can be found in our section on IT threats and attacks.

What we don't know yet

  • The number of people affected: Gleis D has not disclosed how many patients and employees are concerned.
  • A possible ransom demand: asked by Inside IT, the centre did not comment on this point.
  • The actual content of the 87 GB: only the hackers mention identity documents and financial records.

Sources