Unauthorized Access to Clinical Information Held by the Extremadura Health Service

The Extremadura Health Service (SES) detected unauthorized, automated and large-scale access to information available through its Centro de Salud Online (CSOnline) application on October 5, 2026. The connections originated from an anonymous virtual server hosted abroad and affected the confidentiality of clinical information. It has not been publicly disclosed when the activity began before it was detected.

The incident affected 18,416 users of the Extremadura health service and involved more than 334,000 health records, including patient files, documents, illnesses, diagnoses and treatments. The SES activated its protocols, applied containment and corrective measures, reported the incident to the police and notified the AEPD and CCN-CERT. It also informed affected individuals by SMS, CSOnline, email or postal letter.

The latest reported status states that the National Police arrested the alleged perpetrator in Mérida, recovered the copies of the information and prevented their sale on illicit forums; the seized data remains in judicial custody. The SES stated that legitimate access is operating normally and that healthcare systems were not unavailable. The investigation remains open regarding a possible connection with attacks or attempted attacks against other institutions.