ChipSoft, Rijnstate Hospital and Antoni van Leeuwenhoek Hospital: Ransomware attack on company that manages Dutch hospitals' patient files

Dutch Healthcare Provider ChipSoft Hit by Ransomware Attack

ChipSoft, a major healthcare IT provider serving approximately 70% of Dutch hospitals, has suffered a ransomware attack, prompting alerts from Z-Cert, the Dutch healthcare cybersecurity authority. The incident, disclosed on Tuesday, involves "possible unauthorized access," with ChipSoft unable to confirm whether patient data was accessed or exfiltrated. The company is working to mitigate the impact.

ChipSoft’s systems are widely used by hospitals and general practitioners for managing patient records and operational workflows. Z-Cert has advised healthcare institutions to disconnect VPN connections to ChipSoft and monitor network traffic as a precaution.

While the full scope of the attack remains unclear, concerns center on patient portals online platforms where individuals access their medical records. Multiple hospitals using ChipSoft’s systems have reported no disruptions or data breaches. Rijnstate Hospital in Arnhem, Frisus MC in Heerenveen, Antoni van Leeuwenhoek Hospital in Amsterdam, and Franciscus Hospital in Rotterdam have all stated that their patient data remains secure, with some attributing this to isolated or well-protected environments.

The incident highlights ongoing cybersecurity risks in the healthcare sector, where critical infrastructure and sensitive data remain prime targets for ransomware attacks. Investigations into the breach are ongoing.

Source: https://nltimes.nl/2026/04/08/ransomware-attack-company-manages-dutch-hospitals-patient-files

Rijnstate cybersecurity rating report: https://www.rankiteo.com/company/rijnstate

St. Antonius Ziekenhuis cybersecurity rating report: https://www.rankiteo.com/company/st-antonius-ziekenhuis

ChipSoft Nederland cybersecurity rating report: https://www.rankiteo.com/company/chipsoft

"id": "RIJST-CHI1775637791",
"linkid": "rijnstate, st-antonius-ziekenhuis, chipsoft",
"type": "Ransomware",
"date": "4/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'hospitals and general '
                                              'practitioners',
                        'industry': 'healthcare',
                        'location': 'Netherlands',
                        'name': 'ChipSoft',
                        'size': 'major provider serving ~70% of Dutch '
                                'hospitals',
                        'type': 'healthcare IT provider'},
                       {'industry': 'healthcare',
                        'location': 'Arnhem, Netherlands',
                        'name': 'Rijnstate Hospital',
                        'type': 'hospital'},
                       {'industry': 'healthcare',
                        'location': 'Heerenveen, Netherlands',
                        'name': 'Frisus MC',
                        'type': 'hospital'},
                       {'industry': 'healthcare',
                        'location': 'Amsterdam, Netherlands',
                        'name': 'Antoni van Leeuwenhoek Hospital',
                        'type': 'hospital'},
                       {'industry': 'healthcare',
                        'location': 'Rotterdam, Netherlands',
                        'name': 'Franciscus Hospital',
                        'type': 'hospital'}],
 'data_breach': {'data_exfiltration': 'unconfirmed',
                 'personally_identifiable_information': 'possible',
                 'sensitivity_of_data': 'high (medical records)',
                 'type_of_data_compromised': 'patient data (unconfirmed)'},
 'description': 'ChipSoft, a major healthcare IT provider serving '
                'approximately 70% of Dutch hospitals, has suffered a '
                'ransomware attack, prompting alerts from Z-Cert, the Dutch '
                'healthcare cybersecurity authority. The incident involves '
                'possible unauthorized access, with ChipSoft unable to confirm '
                'whether patient data was accessed or exfiltrated. The company '
                'is working to mitigate the impact.',
 'impact': {'data_compromised': 'possible unauthorized access',
            'identity_theft_risk': 'possible if patient data was accessed or '
                                   'exfiltrated',
            'operational_impact': 'VPN disconnections advised, potential '
                                  'disruptions to healthcare services',
            'systems_affected': 'patient records and operational workflows '
                                'management systems'},
 'investigation_status': 'ongoing',
 'ransomware': {'data_exfiltration': 'unconfirmed'},
 'references': [{'source': 'Z-Cert'}],
 'regulatory_compliance': {'regulatory_notifications': 'Z-Cert alert issued'},
 'response': {'containment_measures': 'disconnect VPN connections to ChipSoft, '
                                      'monitor network traffic'},
 'stakeholder_advisories': 'Z-Cert advised healthcare institutions to '
                           'disconnect VPN connections and monitor network '
                           'traffic',
 'title': 'Dutch Healthcare Provider ChipSoft Hit by Ransomware Attack',
 'type': 'ransomware'}