Data Breaches
← Breach overview
ChipSoft is a Dutch healthcare software vendor that provides electronic patient record systems. Its products are widely used in Dutch healthcare institutions.
Key Takeaways
- A ransomware attack on April 7, 2026, exposed patient personal data, including medical records and names, from ChipSoft's hosted services affecting an unknown number of individuals.
- This incident is part of a broader pattern of ransomware attacks targeting the healthcare sector.
- Individuals whose medical records were exposed face a heightened risk of medical identity theft and targeted fraud.
Breach Overview
On April 7, 2026, ChipSoft, a Dutch healthcare software vendor, experienced a ransomware incident. The company publicly acknowledged that attackers exfiltrated patient personal data, including medical records and names, from its hosted services. The affected products included Zorgportaal, HiX Mobile, HAS Relay, and Zorgplatform. While the total number of affected individuals has not been disclosed, the incident impacted dozens of general practices, several rehabilitation clinics, and the Rotterdam Eye Hospital (Oogziekenhuis) using HiX 365. The Dutch Data Protection Authority received over 60 breach notifications related to this incident. ChipSoft's Belgian operations were unaffected.
Exposed Data
Timeline & Cause
The ransomware attack on ChipSoft occurred on April 7, 2026, and the company disclosed the incident on April 12, 2026. The attack was carried out by cybercriminals who gained access to ChipSoft's systems and exfiltrated patient data. Following the discovery, ChipSoft proactively took measures to block further access to potentially affected systems, including temporarily disabling connections to Zorgportaal, HiX Mobile, HAS Relay, and Zorgplatform.
Next Steps
If you are a patient of a Dutch healthcare institution that uses ChipSoft's services, you should monitor communications from your healthcare provider for specific guidance. Given that medical records and personal data were exposed, it is advisable to be vigilant for any suspicious activity related to your medical or financial accounts. Consider placing a fraud alert on your credit and reviewing your medical bills and explanation of benefits for services you did not receive. Be cautious of unsolicited communications, especially those asking for personal information.