HelloBetter—HelloBetter suffered cyberattack exposing mental-health app users' diagnoses, diary entries, and insurance data
Hamburg-based digital therapeutics provider HelloBetter disclosed that attackers breached its business intelligence system on September 6-7, 2026 and exfiltrated a significant volume of data, including contact and insurance details, questionnaire responses, program progress, and free-text diary entries from users of its six prescription digital health apps (DiGA) covering conditions such as depression, panic disorder, and chronic pain. The company said it could not rule out that pseudonymized data remained individually identifiable, and reported the breach to Germany's BSI and the Hamburg data protection commissioner under GDPR Article 34.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| User Privacy | -against | primary | -1.00 |
| Overall incident score = | -0.086 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.57)× agency (incidental ×0.1)
Evidence (1 signal)
heise.de: HelloBetter reports data breach after cyberattack on BI system
heise online reported that HelloBetter detected unauthorized access to its business intelligence system and database on the morning of September 7, 2026, after attackers had already exfiltrated data of significant extent including insurance numbers, questionnaire answers, and diary entries from its mental-health DiGA apps; the company notified Germany's BSI and the Hamburg data protection authority.