ChipSoft says it has prevented stolen data from being published, and that the attackers have now destroyed it.
-
Dutch firm ChipSoft says hackers stole patient medical records in a ransomware attack.
-
The company claims the stolen data was later destroyed by the attackers.
-
It is unclear whether any ransom was paid to secure the deletion.
-
The case highlights risks from “double extortion” ransomware groups targeting healthcare.
Earlier this month, ChipSoft, a Dutch manufacturer of electronic patient record software, became the victim of a ransomware attack.
Initially, ChipSoft said it was unlikely that patients’ personal information was stolen or accessed, but it couldn’t rule it out either. A few weeks later, the software company concluded that the attackers did manage to steal personal data of patients from several Dutch healthcare institutions, including medical records.
The company now claims that all data that was exfiltrated has been deleted by the attackers.
“With the support of cybersecurity experts, we were able to prevent the data from being published. Furthermore, the stolen data has been destroyed. Our cybersecurity experts have confirmed that this destruction was carried out in a technically sound manner,” ChipSoft says on an updated page concerning the recent data breach.
All affected healthcare institutions have been informed about the destruction of the compromised data.
It remains unclear whether ChipSoft paid money to the hackers to erase the stolen data. However, the data breach's outcome seems to point to that conclusion.
According to Dutch news outlet NOS, a ransomware operation called Embargo is responsible for the incident. Last week, the group posted a message on the dark web, claiming that they stole 100GB of patient records from ChipSoft.
Embargo is a new and rather mysterious ransomware operation. It’s unclear who’s behind it and where it comes from. We do know that it has targeted the US health care sector as well.
Research has shown that the criminals behind the group avoid public branding and high-visibility tactics, helping them evade law enforcement and media attention. Embargo doesn’t only encrypt the digital files of their victims: it also downloads corporate information and threatens to release the data to the public. This is called a “double extortion” scheme.
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked