Dutch healthcare tech giant ChipSoft confirms patient records stolen
The threat actor responsible for the ransomware attack on ChipSoft has indeed stolen medical records and other personal information from “several Dutch customers.”
An ultrasound examination. Klaudia Radecka/NurPhoto/Getty.
The threat actor responsible for the ransomware attack on ChipSoft has indeed stolen medical records and other personal information from “several Dutch customers.”
“After forty years of dedication to reliable healthcare IT, it pains us that this situation has arisen. We cannot undo this data breach. However, we are doing everything we can to support the affected customers in this situation as best as possible,” Hans Mulder, CEO of ChipSoft, said in response to the aftermath of the ransomware attack.
Earlier this month, ChipSoft, a manufacturer of electronic patient record software, was targeted by hackers. According to Z-CERT, the Dutch healthcare sector's computer emergency response team, the company had been hit by a ransomware attack.
Hospitals and general practitioner practices were advised to terminate their connection to ChipSoft and to closely monitor their internal networks for suspicious activity.
According to The Volkskrant, 66 healthcare institutions have filed a data breach report with the Dutch data protection authority.
Initially, ChipSoft said it was unlikely that patients' personal information was stolen or accessed, but it couldn’t rule it out. As the days passed, concerns arose that patient data may have been stolen. This has now been confirmed by ChipSoft.
“The forensic investigation has since revealed that these criminals did indeed steal personal data of patients, including medical records, from several Dutch healthcare institutions,” the company says on a FAQ page dedicated to the cybersecurity incident.
All affected healthcare institutions have been notified of the data breach. Institutions that manage ChipSoft’s software in-house or have it managed by third parties are not affected.
The forensic investigation has not yet been completed. ChipSoft promises to notify the affected healthcare institutions as soon as new information becomes available.
Mirjam Sterk, Minister of Long-term Care, Youth, and Sport, stated that ChipSoft “must pull out all the stops to investigate this quickly and thoroughly.”
She told Dutch news outlets that this is a serious matter. “Patients must be able to trust that their data is secure,” Minister Sterk said.
Unlock more exclusive Cybernews content on YouTube.