Read as EU-wide, weighted to France, the Netherlands and Spain, where this week's reporting concentrated. Most breach items rest on leak-site or hacker claims rather than victim confirmation; each is labelled below.
01Exploited vulnerability · CVE-2026-88771/88772 · Sep 27Exploited Citrix NetScaler flaws shut Dutch hospital patient portals
Citrix patched eight NetScaler ADC/Gateway flaws; it reported exploitation of CVE-2026-88771 (unauthenticated remote command execution, CVSS v4 9.5) and CVE-2026-88772 (memory overflow leading to RCE or DoS when DTLS is on, 9.5), per NCSC-NL. Vulnerable: 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus FIPS builds. Z-CERT told Dutch care providers to disable exposed systems or tighten monitoring; Amphia, ETZ and Frisius MC pulled portals offline, per press. I could not confirm a CISA KEV entry or due date.
Amphia says the outage was an IT disruption and not a hack; no data theft has been reported. GDPR angle: with no confirmed personal-data compromise, no Art. 33 notification to the Dutch AP is yet triggered. If forensics find exploitation of internet-facing appliances, the 72-hour clock runs from awareness (likely; confirm with counsel).
Defend: Upgrade NetScaler to 14.1-73.37 or 13.1-64.23 or later, capture logs and memory first, and run Citrix's IoC scan script.
02Disclosed breach · Alaxione / Point Vision · Sep 28Hacker claims 16.2 million records from French appointment vendor Alaxione
ChimeraZ first claimed 8.6M patients on Sep 28, then 16,221,383 people, 568,737 unique social security numbers and 168 centres, 67 of them Point Vision, per Cyberattaque.org. These totals are the hacker's claim. The outlet reviewed 31 samples (30,550 rows) consistent with patient, appointment, SMS and messaging data, but could not verify volumes. Point Vision separately confirmed in mid-September that an appointment-management provider was breached, and it said part of the attacker's traces had been deleted.
The link between the two is inferred by the outlet, not confirmed by either company or an authority. GDPR angle: the provider as processor must notify each controller without undue delay (Art. 33(2)); controllers likely owe CNIL notice within 72 hours of awareness and, given social security numbers and appointment reasons, Art. 34 patient notice (confirm with counsel).
Defend: Health networks using third-party booking tools should rotate vendor credentials, force password resets, and warn patients about phishing built from appointment details.
03Disclosed breach · Orkyn (Air Liquide Healthcare) · Oct 1Orkyn confirms theft of patient health data, detected Sep 19
Orkyn, a French home-healthcare provider, told patients that unauthorised parties accessed a file containing identity data, social security numbers, prescribing doctors, therapy, treatment adherence and billing codes, per a patient email seen by Cyberattaque.org. It detected the incident on Sep 19 and suspended its patient portal. The patient count was not stated; a hacker claims about 18,000 profiles, which is unconfirmed. Orkyn says medical devices are technically separate from the compromised database. The access method is undisclosed.
GDPR angle: confirmed health data makes Art. 33 notice to CNIL (72 hours from awareness) and Art. 34 direct patient notice likely required; Orkyn has already emailed patients (confirm with counsel).
Defend: Home-care and device providers should isolate patient-portal databases from device telemetry, enforce MFA and log retention, and brief patients on fake clinician calls.
04Ransomware · CNEH · Sep 30Kairos ransomware group claims 645 GB from French hospital-expertise body CNEH
Kairos added the Centre National de l'Expertise Hospitalière to its leak site on Sep 30 and claims about 645 GB, per Cyberattaque.org. Screenshots it posted reportedly show ID cards, bank details, social security numbers, salary tables and CVs. CNEH has not publicly confirmed the scope or the number of people affected. The 645 GB figure is the attackers' claim.
GDPR angle: if the data is genuine, Art. 33 notice to CNIL within 72 hours of awareness is likely, and Art. 34 notice to staff and trainers is likely given ID and bank data (confirm with counsel).
Defend: Hospital suppliers should restrict and encrypt HR and onboarding files, require MFA on remote access, and keep offline backups; staff should watch for bank and identity fraud.
05Ransomware · Hospital Sant Pau · Oct 2The Gentlemen list Barcelona's Sant Pau hospital; no confirmation yet
The Gentlemen ransomware group listed Hospital de la Santa Creu i Sant Pau on its leak site, detected Oct 2. Escudo Digital reports the claim is unverified: Sant Pau's incident page shows no confirmation, no data volume was claimed, and the regional health department has not commented. Unit 42 tracks the group as Storm-2697, per the same report.
GDPR angle: if an intrusion is confirmed, notice to Spain's AEPD or the Catalan data protection authority would be due within 72 hours of awareness (Art. 33), with Art. 34 patient notice likely if health records were taken (confirm with counsel).
Defend: Hospitals should patch VPN and edge devices, enforce MFA on remote access, and watch leak sites for their own name.
Enable JavaScript to read this edition.