Security alarm at EPA: Hackers find new weaknesses!

Security alarm at EPA: Hackers find new weaknesses!

Deutschland - On April 30, 2025, Federal Minister of Health Karl Lauterbach made a sobering message about security gaps in the electronic patient file (EPA). The minister confirmed that the new security measure of the EPA was apparently successfully avoided after its start. Lauterbach expressed his thanks to the Gematik, which is responsible for the EPA, for their quick action to close the security weaknesses. This is reported by the Tagesspiegel .

A report by the "Spiegel" focused on the inadequate EPA safety precautions. Ethics hackers of the Chaos Computer Club (CCC) had overcome a newly added protective measure and informed the authorities. The gematics had already been informed before the report was published. The minister pointed out that a new safety precaution was installed to close the previously identified weaknesses. However, this measure has now also been classified as not sufficiently effective.

criticism of the security precautions

critics, including CCC experts, warned of a hasty introduction of the EPA. As early as December 2022, security researchers demonstrated serious defects in the system. In addition, experts fear that the EPA will not meet the security standards required by the Federal Office of Information Technology (BSI). According to pharmacies Umschau , a new security mechanism was referred to as "proven". Despite these alarming reports, the Gematik has not reported any evidence of unauthorized access to the EPA, which, according to experts, remains controversial.

cybercrime is a serious threat to the healthcare system. According to Itsicherheit-Online goals more and more attacks and more attacks Health service providers, especially on sensitive patient data and networked medical devices. A successful cyber attack could not only cause high financial damage, but also the security of patient: endangering inside.

The introduction of the EPA was previously announced by Lauterbach as determined after all hacker attacks were technically impossible. The minister had pointed out the importance of a solid digital infrastructure in the health sector. Nevertheless, the current situation shows that this new measure cannot offer the hoped -for security. It remains to be hoped that the Gematik takes further steps to protect the EPA-sensitive data and not to further undermine the trust of the population in digital health care.