Einstein confirms attack on patient data

Update October 16, 2026: Einstein said it identified a suspected incident on August 4, 2026 and took technical and operational steps to confirm the unauthorized access and contain it. Agência Estado/UOL also reported that the hospital was still working to determine which data had actually been accessed and the true scope of the case.

The Albert Einstein Israelite Hospital in São Paulo confirmed a cyberattack that resulted in unauthorized access to part of its patient database. The institution notified Brazil's ANPD and the Federal Police, and said patient care was not affected and hospital operations continued normally.

What kind of data was exposed?

The accessed information included registration data such as names, CPF numbers and or dates of birth, and may also have included medical prescriptions and exam results, according to several reports based on the hospital's communication. In G1's reporting, those details were described as part of the database reached in the incident.

Public confirmation came after the hospital acknowledged unauthorized access to patient data. Folha reported that the institution recognized the attack, while SBT News said the case was reported to the competent authorities.

Was medical care affected?

No, the hospital said patient care was not affected and that its systems and electronic records continued to operate normally. Correio Braziliense added that there was no impact on care or on the continuity of operations.

That point was repeated in the cited coverage, in line with the institution's position. Based on the material provided, there are no indications of service interruption or a shutdown of clinical systems.

What is known about the investigation?

The Federal Police is investigating the case and, according to iG and IT Forum, it may be linked to a ransomware attack and an alleged extortion attempt, although those details remain attributed to those outlets. IT Forum also reported Operação Insidioso, including a search warrant and a temporary detention in Joinville, Santa Catarina, after an investigation that lasted about two months.

According to that coverage, the suspect allegedly helped the criminal group extract data. CNN Brasil also described the episode as an intrusion and extortion attempt against the hospital, but without elements that would allow independent verification of the operational scope of that extortion.

What did the hospital do for affected patients?

According to SpaceMoney, citing TecMundo, the Albert Einstein Israelite Hospital had begun notifying affected patients individually by email after their data was accessed without authorization. That communication came in addition to the notices already sent to the ANPD and the Federal Police.