Dutch healthcare IT vendor ChipSoft said it detected anomalies on April 7 that proved to be a ransomware attack, and forensics confirmed criminals stole patient personal data, including medical data, from some Dutch customers [1]. ChipSoft cut connections to its hosted Zorgportaal patient portals, HiX Mobile and the Zorgplatform exchange from April 8; according to NOS, the Embargo group claimed 100 GB of data, and ChipSoft later said the data was destroyed without saying whether it paid [2][3][4]. Patients of affected providers should watch for notices from their care provider, which ChipSoft says handles communication with patients [1].
Dutch healthcare software firm ChipSoft hit by ransomware; patient medical data stolen from some providers, patient portals taken offline
1 min read
- Disclosed
- Apr 7, 2026
- Occurred
- Apr 7, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Healthcare
What to do nowOur advice
- Patients of affected providers should watch for notices from their care provider, which handles communication [1].
Timeline
Technical details
Remediation
Vendor guidance
- 1Watch for provider notices verify[1]
Patients should watch for notices from their care provider.
References
Official / primary2
- [1]ChipSoft2026-04-17Accessed 2026-11-11Snapshot 2026-11-11 sha256 0e49253ffa37
“Ja, forensisch onderzoek heeft inmiddels uitgewezen dat deze criminelen daadwerkelijk persoonsgegevens van patiënten, waaronder medische gegevens, van enkele Nederlandse klanten hebben ontvreemd.”
- [2]ChipSoft2026-04-09Accessed 2026-11-11
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.