Loading story…
Dutch healthcare software vendor ChipSoft was hit by a ransomware attack that knocked its website offline and disrupted parts of its service footprint, according to Z-CERT, the Netherlands' healthcare sector CERT. ChipSoft provides patient record software used by about 80 percent of hospitals in the Netherlands, making the incident significant for the national healthcare system. While most hospitals were still able to keep patient portals running, local reporting said 11 hospitals took ChipSoft software offline, including several that depend on it heavily.
Z-CERT said it is coordinating with ChipSoft, healthcare institutions, and other partners to assess the impact, and urged organizations to audit ChipSoft-connected systems for unusual traffic and report suspicious activity. The threat actor has not been identified, but the incident adds to mounting concern over ransomware and extortion targeting healthcare providers in the region, following other recent attacks affecting healthcare organizations in the Netherlands and Belgium and renewed warnings about risks to operational continuity and patient safety.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After the April 7 ransomware attack, ChipSoft shut down connections to several platforms, including Zorgportaal, HiX Mobile, and Zorgplatform, causing temporary disruptions while systems were restored and credentials reissued. The company also said it could not rule out unauthorized access to or theft of patient data.
Z-CERT said it was coordinating with ChipSoft, healthcare institutions, and partners to assess the impact of the ransomware incident. It also advised organizations to audit ChipSoft systems for unusual traffic and report suspicious findings.
Following the attack, local reporting indicated that 11 hospitals took ChipSoft software offline, including nine that depend on it more extensively. Most hospitals were still able to keep patient portals operating despite the disruption.
On April 7, 2026, Dutch healthcare software vendor ChipSoft suffered a ransomware attack that took its website offline. ChipSoft supplies patient record software to roughly 80 percent of hospitals in the Netherlands, making the incident significant for the healthcare sector.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcenrc.nl
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcenrc.nl
Open sourcego.theregister.com
Open sourcetheregister.com
Open sourcenos.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Confirmed ransomware activity has remained persistently high worldwide, with a Ransomnews dataset logging **9,291 verified attacks** since 2018 and roughly **1,400 to 1,550 incidents annually** since 2023. **LockBit** remains the leading group by confirmed victims since 2019, while **Qilin** leads 2026 year-to-date with 53 confirmed victims, followed closely by **The Gentlemen** with 51. The **United States** accounts for about half of confirmed attacks in the dataset, and healthcare remains one of the most heavily affected sectors, with **1,297 confirmed healthcare incidents** recorded across the full period. Attacks on healthcare accelerated further in the first half of 2026, with overall incidents rising **14%** and attacks on healthcare businesses and service providers jumping **35%** from the second half of 2025 and **110%** from a year earlier. Reporting attributes the shift to criminals targeting central vendors and service providers to reach multiple downstream hospitals and steal large volumes of sensitive data; recent examples include incidents involving **University of Mississippi Medical Center**, **Unimed**, **TriZetto Provider Solutions**, and **QualDerm Partners**. Security leaders say hospitals and clinics still face chronic exposure from legacy medical devices, patching constraints, third-party dependence, limited budgets and staffing, and social-engineering attacks, raising the risk of operational disruption and patient-care delays.
Jul 10, 2026
Ransomware attacks have repeatedly crippled hospital operations, forcing providers to divert care, lose access to critical systems, and in some cases pay attackers to recover. At Hollywood Presbyterian Medical Center in Los Angeles, malware encrypted files and disrupted the hospital's computer network, prompting executives to pay about **$17,000 in bitcoin** after attackers reportedly reduced an initial demand of **$3.4 million**. The outage interfered with administrative functions and highlighted how cyberattacks on healthcare can create direct patient-safety risks. The threat later scaled across national healthcare systems. The **WannaCry** outbreak spread to nearly 100 countries and severely impacted the UK's **NHS**, knocking hospitals and clinics offline and disrupting appointments and treatment. In Romania, a ransomware attack on a healthcare IT platform left multiple hospitals offline, underscoring how attacks on shared digital infrastructure can cascade across many facilities at once and paralyze care delivery well beyond a single organization.
Jun 29, 2026
A ransomware attack hit facility maintenance systems at **Health Sciences Centre** in Winnipeg, disrupting building operations including **door access** and **heating, ventilation, and air conditioning (HVAC)** controls. Shared Health, which oversees the hospital, said **patient care and clinical operations continued uninterrupted** and that there was **no indication patients were affected**. The organization said the incident appeared limited to those systems and that no other hospital systems were known to be impacted. Shared Health said it launched an investigation into the nature and scope of the attack, notified the Manitoba government, and brought in expert assistance to respond. Reporting on the incident highlighted the growing risk ransomware poses to **operational technology** in healthcare environments, where attacks can disrupt physical infrastructure even when core clinical systems remain online. The attack also follows earlier warnings from Manitoba’s auditor general that Shared Health needed stronger cybersecurity testing and training to improve its readiness for cyber incidents.
Aug 13, 2026