{"id":"chipsoft-ransomware-patient-data-apr-2026","category":"breach","status":"closed","title":"ChipSoft ransomware steals patient records and disrupts healthcare services","tldr":"Ransomware at ChipSoft stole Dutch patients’ personal and medical information and disrupted portals and mobile services. ChipSoft says the stolen data was destroyed. Ask your healthcare provider whether your records were involved.","summary":"ChipSoft detected ransomware on 7 April 2026. Attackers stole patients’ personal and medical information from several Dutch healthcare customers; no patient count was published. ChipSoft said installations managed by providers themselves or third parties were not affected by the breach, and no Belgian patient information was stolen. Precautionary disconnections disrupted patient portals, mobile applications and data exchange. Z-CERT reported logistical problems but no stopped critical care processes on 9 April. On 28 April, ChipSoft said it had prevented publication and secured destruction of the stolen data, a claim attributed to the company and its specialists. Almost all portals and data-exchange connections were restored by May; a June mobile release addressed remaining certificate-related access problems. RDI announced a security investigation in July. No investigation outcome was found in the sources checked through 3 November. The initial access method remains publicly unexplained.","action":"Ask your healthcare provider whether your records were involved and follow its notification. Check unexpected messages about the incident through your provider’s usual contact details before sharing information or following links.","product":"ChipSoft healthcare services, including Zorgportaal, Zorgplatform and HiX Mobile","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["chipsoft","ransomware","data-breach","healthcare","netherlands"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Veelgestelde vragen — ransomware-incident","url":"https://informatie.chipsoft.com/chip-soft-informatiepagina-ransomware-incident/veelgestelde-vragen","by":"ChipSoft","date":"2026-06-17"},{"kind":"advisory","title":"Ransomware-aanval","url":"https://www.chipsoft.com/nl-nl/nieuws-en-blogs/ransomware-aanval/","by":"ChipSoft","date":"2026-06-04"},{"kind":"advisory","title":"Ransomware-incident bij ChipSoft — UPDATE","url":"https://z-cert.nl/actueel/nieuws/update-over-ransomware-incident-bij-chipsoft","by":"Z-CERT","date":"2026-04-09"},{"kind":"advisory","title":"Update over ransomware-incident bij ChipSoft","url":"https://z-cert.nl/actueel/nieuws/update-over-ransomware-incident-bij-chipsoft-2","by":"Z-CERT","date":"2026-04-14"},{"kind":"news","title":"Healthcare IT solutions provider ChipSoft hit by ransomware attack","url":"https://www.bleepingcomputer.com/news/security/healthcare-it-solutions-provider-chipsoft-hit-by-ransomware-attack/","by":"BleepingComputer","date":"2026-04-09"},{"kind":"advisory","title":"RDI onderzoekt beveiligingsmaatregelen ChipSoft naar aanleiding van ransomware-aanval","url":"https://www.rdi.nl/actueel/nieuws/2026/07/13/rdi-onderzoekt-beveiligingsmaatregelen-chipsoft-naar-aanleiding-van-ransomware-aanval","by":"Rijksinspectie Digitale Infrastructuur","date":"2026-07-13"}],"started":"2026-04-07","closed":"2026-07-13","created":"2026-11-03T20:55:34.038Z","updated":"2026-11-03T20:55:34.038Z","cve_notes":[],"timeline":[{"at":"2026-07-13","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Dutch regulator RDI announced an investigation into ChipSoft’s security measures, the circumstances of the attack and its impact.","url":"https://www.rdi.nl/actueel/nieuws/2026/07/13/rdi-onderzoekt-beveiligingsmaatregelen-chipsoft-naar-aanleiding-van-ransomware-aanval","by":"Rijksinspectie Digitale Infrastructuur","patch":null},{"at":"2026-06-17","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"ChipSoft released HiX Mobile with support for replacement HAS Relay certificates, restoring access for institutions affected by certificate changes. HAS Relay connections required new device enrolments.","url":"https://informatie.chipsoft.com/chip-soft-informatiepagina-ransomware-incident/veelgestelde-vragen","by":"ChipSoft","patch":null},{"at":"2026-05-12","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"ChipSoft reported that almost all providers had restored their patient portals and reconnected to Zorgplatform. Other recovery work continued.","url":"https://www.chipsoft.com/nl-nl/nieuws-en-blogs/ransomware-aanval/","by":"ChipSoft","patch":null},{"at":"2026-04-28","added":"2026-11-03T20:51:54.186Z","kind":"vendor-revised","text":"ChipSoft said publication had been prevented and the stolen data destroyed, with its cybersecurity specialists confirming that the destruction was technically sound.","url":"https://www.chipsoft.com/nl-nl/nieuws-en-blogs/ransomware-aanval/","by":"ChipSoft","patch":null},{"at":"2026-04-16","added":"2026-11-03T20:51:54.186Z","kind":"vendor-revised","text":"ChipSoft confirmed theft of patients’ personal and medical information from several Dutch customers and began notifying affected providers. It reported no Belgian patient-data theft.","url":"https://www.chipsoft.com/nl-nl/nieuws-en-blogs/ransomware-aanval/","by":"ChipSoft","patch":null},{"at":"2026-04-09","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Z-CERT reported extra pressure on service desks and telephone support, but said no critical care processes had stopped at that point.","url":"https://z-cert.nl/actueel/nieuws/update-over-ransomware-incident-bij-chipsoft","by":"Z-CERT","patch":null},{"at":"2026-04-08","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"ChipSoft disconnected its hosted Zorgportaal patient portals, Zorgplatform data exchange and all HiX Mobile applications as a precaution.","url":"https://www.chipsoft.com/nl-nl/nieuws-en-blogs/ransomware-aanval/","by":"ChipSoft","patch":null},{"at":"2026-04-07","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"ChipSoft detected unusual activity, brought in external cybersecurity specialists and informed customers of a data incident.","url":"https://informatie.chipsoft.com/chip-soft-informatiepagina-ransomware-incident/veelgestelde-vragen","by":"ChipSoft","patch":"na"}],"url":"https://hard.fyi/live/chipsoft-ransomware-patient-data-apr-2026/","json":"https://hard.fyi/api/live?id=chipsoft-ransomware-patient-data-apr-2026"}