BIG direkt gesund

Profile narrative

BIG direkt gesund, operating under the alias BIG, is a German health insurer that provides statutory health insurance coverage to its members. As a Krankenversicherung entity operating within the German healthcare system, the organisation delivers health insurance products and services to insured individuals, handling sensitive personal and medical information as part of its core operations. The insurer's public-facing communications, including its official website at big-direkt.de, indicate its role in managing policyholder data and responding to member inquiries.

The organisation became publicly known in connection with a cybersecurity incident disclosed on 28 March 2023. According to information released by the company, an unauthorized access event compromised its IT systems and resulted in the exfiltration of sensitive health information belonging to its members. The breach was identified through monitoring activities that detected the appearance of company data on the Darknet. BIG has stated that an ongoing forensic analysis is being conducted to determine the full scope of the data affected, and the insurer committed to notifying individuals directly if their personal information is confirmed to be among the published data set.

In response to the incident, BIG initiated collaboration with external IT security experts, law enforcement authorities, German data protection regulators, and the Bundesamt für Sicherheit in der Informationstechnik (BSI), the federal cybersecurity agency. The company began a process of rebuilding its affected systems and has stated its intent to strengthen its security protocols to prevent future incidents. A dedicated hotline was established for affected individuals seeking further information about the breach and its potential impact on their personal data. While the precise scale of the compromise has not been publicly quantified, the nature of the response and engagement with national cybersecurity authorities indicates the severity attributed to the event by both the company and relevant regulatory bodies.

Incidents

1 incident linked to this organisation.