Spain's INCIBE-CERT reported that a security incident was detected on July 9, 2024 across multiple hospitals and health management entities in Granada [1]. Officials explained that the incident initially affected hospital websites, and a subsequent investigation revealed that data belonging to current and former employees of the Andalusian Health Service (SAS) had been leaked [1]. SAS is cooperating with relevant authorities and law enforcement in the investigation [1].
Backfill: this event became public on Jul 9, 2024 and we added it on Nov 8, 2026. It is not a new event.
HighMonitoringBackfillOfficially confirmed
Spain's INCIBE Reports Cyberattack on Andalusian Health Service and Employee Data Leak
1 min read
- Disclosed
- Jul 9, 2024
- Published
- Nov 8, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- Attack vector
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Healthcare, Government
What to do nowOur advice
SAS is cooperating with relevant authorities and law enforcement in the investigation [1].
Timeline
- Public disclosure of incident[1]
Technical details
Source-Supported Details
INCIBE's English summary noted that hospital websites in Granada, including San Cecilio and Virgen de las Nieves, experienced a security incident and that the ensuing investigation uncovered a leak of SAS employee data. The number of affected individuals is subject to the original source [1].
Source excerpt for verification: "An investigation was started in which the data from 50,000 employees and former employees of the Andalucia Health Service (SAS) was discovered to be leaked." [1].
References
Official / primary1
- [1]
“An investigation was started in which the data from 50,000 employees and former employees of the Andalucia Health Service (SAS) was discovered to be leaked.”
Corrections
- · confirmation_status: media_reported → official_confirmedINCIBE-CERT（incibe.es）現已列為官方 CERT。其已存檔英文摘要將 2024 年 7 月 9 日格拉納達多家醫院的安全事件，以及後續發現 SAS 約 5 萬名現任與前任員工資料外洩，作為事實記載。據此將 confirmation_status 改為 official_confirmed。
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.