Germany's Charité university hospital disclosed on Oct 30 that attackers breached the web server that also hosts its website and took personal contact data.

• Data: first and last names, email addresses and, where given, organizational affiliation. Regional reporting (MAZ) says staff usernames were also taken. Charité says special-category health data under Art. 9 GDPR was "expressly not affected", but people who typed details into the appointment form's free-text field are being informed individually.
• Scale (spokesperson to Deutsches Ärzteblatt): about 46,000 staff and students, about 1,500 press and newsletter recipients and about 90,000 contact-form users.
• Response: servers were isolated (the website was partly offline on Oct 27), the access path was identified and closed, a criminal complaint was filed, and regulators were notified. Charité says there is no sign so far the data was published or misused, and that the incident is not related to the PHP flaws that led it to take its site offline on Oct 21.

What to do: the stolen data is the raw material for targeted phishing and vishing. Charité staff and contacts should expect messages that reference Charité work, and Charité says it will never phone people to ask for passwords. Organizations that share web and contact-form infrastructure should keep form submissions off the public web host.