ChipSoft confirms patient data stolen in 7 April ransomware attack

Data theft confirmed after earlier denial

DutchNews reported that ChipSoft has confirmed patient data was stolen in the attack, after first telling clients that personal data was "probably" safe. The company had earlier told NOS it could not rule out that patient records had been seen or stolen. The hackers targeted medical information about treatments, and the stolen data has not yet appeared on the dark web, according to the Volkskrant. The Dutch data protection authority has received 66 reports of a data breach linked to the attack, including one from ChipSoft itself.

The attack began on 7 April 2026. Z-CERT, the computer emergency response team for the Dutch healthcare sector, confirmed the ransomware element in an advisory the following morning and advised hospitals to cut their VPN connections. ChipSoft told NOS it had suffered a "data incident" involving "possible unauthorised access". The company locked the attackers out immediately after the hack was discovered, a spokesperson said.

One supplier, seven in ten hospitals

ChipSoft's HiX platform is used by roughly 70% of Dutch hospitals, according to The Record, Cybernews and DutchNews. Safestate put the share at approximately 80%, or four in five hospitals. NOS reported that eleven hospitals temporarily disconnected ChipSoft software from their networks after the attack, with systems unavailable at Sint Jans Gasthuis in Weert, Laurentius Hospital in Roermond, VieCuri Medical Center in Venlo and Flevo Hospital in Almere. Slingeland, Rijnstate, Franciscus, Diakonessenhuis, Frisius MC and Tergooi MC were also among the eleven that took patient portals offline. ChipSoft disabled connections to Zorgportaal, HiX Mobile and the Zorgplatform as a precaution, The Record reported. Most hospitals stayed connected, a NOS survey cited by Cybernews found.

Scope wider than cloud customers

DutchNews reported that the attack hit family doctors, rehabilitation clinics and the Rotterdam Eye Hospital, which all use ChipSoft's cloud-hosted HiX 365 platform, and that hospitals running the technology on their own servers were not affected. Cybernews, citing a Z-CERT advisory, listed HiX on-premise, HiX SaaS and the SaaS Patient Portal among the affected software, a wider scope. Rijnstate and Franciscus said patient data remained secure because it was stored in isolated environments rather than on ChipSoft's central infrastructure.

The records at risk contain names, addresses, national identification numbers, diagnoses, treatment histories and insurance details, according to Safestate. Dozens of family doctors' practices use the system, the association LHV said, with the largest group in North Limburg.

CEO Hans Mulder said the company could not undo the theft. "We are doing everything we can to support the affected customers as best as possible," he said via social media. The Dutch Patients' Federation said the lack of information for patients had gone on too long. "Patients need to know where they stand, especially when it involves sensitive medical data," the organisation said.

What happens next

Leiden University Medical Center has temporarily postponed the rollout of a new electronic patient record system supplied by ChipSoft. The hospital said there were no indications that its patients' data had been leaked. No ransomware group has claimed responsibility, and the identity of the attackers remains unknown. ChipSoft has not said whether it is negotiating with the attackers, according to the Volkskrant.

Z-CERT said the disruption caused mostly logistical problems rather than critical medical issues. "No critical care processes have come to a standstill," the organisation said. Hospitals increased staffing at service desks and phone lines, and shifted communication between institutions to telephone systems.