NewsCompaniesFlawsGuides
Get the app
HighClosedUpdated

ChipSoft ransomware steals patient records and disrupts healthcare services

Ransomware at ChipSoft stole Dutch patients’ personal and medical information and disrupted portals and mobile services. ChipSoft says the stolen data was destroyed. Ask your healthcare provider whether your records were involved.

What to do

Ask your healthcare provider whether your records were involved and follow its notification. Check unexpected messages about the incident through your provider’s usual contact details before sharing information or following links.

What’s happening

ChipSoft detected ransomware on 7 April 2026. Attackers stole patients’ personal and medical information from several Dutch healthcare customers; no patient count was published. ChipSoft said installations managed by providers themselves or third parties were not affected by the breach, and no Belgian patient information was stolen. Precautionary disconnections disrupted patient portals, mobile applications and data exchange. Z-CERT reported logistical problems but no stopped critical care processes on 9 April. On 28 April, ChipSoft said it had prevented publication and secured destruction of the stolen data, a claim attributed to the company and its specialists. Almost all portals and data-exchange connections were restored by May; a June mobile release addressed remaining certificate-related access problems. RDI announced a security investigation in July. No investigation outcome was found in the sources checked through 3 November. The initial access method remains publicly unexplained.

What
Breach
Affects
ChipSoft healthcare services, including Zorgportaal, Zorgplatform and HiX Mobile
Fixed in
Nothing to patch
Since
7 Apr 2026
Closed
13 July 2026

Timeline

  1. Update

    Dutch regulator RDI announced an investigation into ChipSoft’s security measures, the circumstances of the attack and its impact.

  2. Update

    ChipSoft released HiX Mobile with support for replacement HAS Relay certificates, restoring access for institutions affected by certificate changes. HAS Relay connections required new device enrolments.

  3. Update

    ChipSoft reported that almost all providers had restored their patient portals and reconnected to Zorgplatform. Other recovery work continued.

  4. Vendor revised

    ChipSoft said publication had been prevented and the stolen data destroyed, with its cybersecurity specialists confirming that the destruction was technically sound.

  5. Vendor revised

    ChipSoft confirmed theft of patients’ personal and medical information from several Dutch customers and began notifying affected providers. It reported no Belgian patient-data theft.

  6. Update

    Z-CERT reported extra pressure on service desks and telephone support, but said no critical care processes had stopped at that point.

  7. Update

    ChipSoft disconnected its hosted Zorgportaal patient portals, Zorgplatform data exchange and all HiX Mobile applications as a precaution.

  8. Made publicNothing to patch

    ChipSoft detected unusual activity, brought in external cybersecurity specialists and informed customers of a data incident.

Sources

  1. Veelgestelde vragen — ransomware-incidentChipSoft · 17 June 2026
  2. Ransomware-aanvalChipSoft · 4 June 2026
  3. Ransomware-incident bij ChipSoft — UPDATEZ-CERT · 9 Apr 2026
  4. Update over ransomware-incident bij ChipSoftZ-CERT · 14 Apr 2026
  5. Healthcare IT solutions provider ChipSoft hit by ransomware attackBleepingComputer · 9 Apr 2026
  6. RDI onderzoekt beveiligingsmaatregelen ChipSoft naar aanleiding van ransomware-aanvalRijksinspectie Digitale Infrastructuur · 13 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS