ChipSoft, the Amsterdam vendor whose HiX electronic health record runs most Dutch hospitals, has confirmed that patient data was stolen in the ransomware attack that began on 7 April 2026. DutchNews reported the confirmation. It reverses ChipSoft's earlier message to clients that personal data was "probably" safe. Reports of HiX's market share differ. The Record, Cybernews and DutchNews put it at about 70% of Dutch hospitals. An early 2026 market survey by consultancy M&I/Partners, cited by integration firm Isatis, puts it at 76%. Security firm Safestate puts it at about 80%. The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), has reportedly received 66 data breach reports linked to the attack, one of them from ChipSoft itself. No group has publicly claimed the attack in any reporting so far, and ChipSoft has not named the attackers.
What Happened
The intrusion began on 7 April 2026. Z-CERT, the computer emergency response team for the Dutch healthcare sector, confirmed the ransomware element in an advisory the next morning. It told hospitals to cut their VPN connections to ChipSoft. At first ChipSoft described the event to broadcaster NOS as a "data incident" involving "possible unauthorised access". A spokesperson said the company locked the attackers out as soon as the hack was found.
From 8 April, ChipSoft cut connections to its patient-facing services as a precaution, including Zorgportaal, HiX Mobile and Zorgplatform. Dutch IT firm Breinstein says these services only began coming back in stages from 17 April. NOS reported that eleven hospitals temporarily disconnected ChipSoft software from their networks. Systems were unavailable at Sint Jans Gasthuis in Weert, Laurentius Hospital in Roermond, VieCuri Medical Center in Venlo and Flevo Hospital in Almere. Slingeland, Rijnstate, Franciscus, Diakonessenhuis, Frisius MC and Tergooi MC were among the hospitals that took patient portals offline.
Accounts of who was hit hardest differ. Breinstein says GP practices and pharmacies had the most disruption and that the impact on hospitals was more limited. Other reports, which are not independently confirmed, say ChipSoft first told hospitals that mainly GP records were affected. Those reports say it later emerged that hospital records on the HiX365 patient platform may also have been reached. They describe HiX365 as used by about 15 hospitals, including Franciscus Gasthuis in Rotterdam and Albert Schweitzer Hospital in Dordrecht.
The company's public message shifted in three steps. First it said data was "probably" safe. Then it told NOS it could not rule out that patient records had been seen or stolen. Now it has confirmed the theft.
What Was Taken
ChipSoft has confirmed that patient data was stolen. It has not published a record count, a list of affected institutions, or the exact data fields involved, and no figure for the number of affected patients has appeared in reporting.
According to de Volkskrant, the attackers went after medical information about treatments. That is among the most sensitive categories of personal data under the GDPR. Breinstein reports that the attackers threatened to publish the data. De Volkskrant reports that the data has not yet appeared on the dark web.
The 66 breach reports to the AP give the best available sense of scale. They suggest that dozens of care organisations, each a data controller in its own right, consider their patients' data exposed. The AP has confirmed receiving reports from several hospitals but has declined to give details while its investigation continues.
Why It Matters
This is a supply-chain compromise of national health infrastructure. Whichever market-share figure is right (70%, 76% or 80%), one vendor holds clinical data and patient-facing services for a large majority of Dutch hospitals. HiX also runs in GP practices, pharmacies, mental health care, rehabilitation and elderly care. Breinstein describes the pattern as "one supplier, tens to hundreds of affected care organisations".
The incident fits a trend Z-CERT has been reporting for years: attackers increasingly target IT suppliers in the care chain, not just the care providers. Breinstein cites AP figures showing that 41% of all data breaches reported in the Netherlands come from hospitals and related organisations.
Two points stand out for defenders:
- Integration paths are attack paths. Hospitals were told to cut VPN tunnels to the vendor, and ChipSoft shut down the portal and API layer (Zorgplatform, which Isatis notes carries FHIR integrations). Both show how far vendor connectivity reaches into hospital environments. Reports also say ChipSoft support staff had access to hospital accounts. This is not independently confirmed, but if true it is the kind of privileged vendor access that makes one breach spread to many organisations.
- Early reassurance did not hold. ChipSoft moved from "probably safe" to confirmed theft. Customers that waited for vendor confirmation before filing their own breach reports and preparing patient notifications lost time. Ransomware groups commonly steal data before they encrypt anything, so the safer working assumption is that data was taken until there is evidence it wasn't.
The Attack Technique
The initial access method has not been disclosed. ChipSoft, Z-CERT and the AP have not said publicly how the attackers got in, which ransomware strain was used, or who was behind it. Z-CERT's VPN guidance shows that the vendor-to-customer remote access link was treated as a likely route for the attack to spread. It does not show how the attackers first got in.
Two unrelated reports published this autumn show what techniques current extortion groups are using. They have no known connection to ChipSoft. Kaspersky's Securelist describes ransomware operator Storm-2603 exploiting the ToolShell flaws in on-premises SharePoint (CVE-2025-53770 and CVE-2025-53771). The attackers ran their webshell entirely inside the IIS worker process (w3wp.exe), tried to disable EDR tools, and then attempted to deploy ransomware. BleepingComputer reports, based on Google's Mandiant and Threat Intelligence Group, that ShinyHunters got around WAF rules protecting Oracle PeopleSoft (CVE-2026-35273) by URL-encoding the blocked path. Requesting /%50SEMHUB/ instead of /PSEMHUB/ slipped past filters that check the path before decoding it. Both cases point the same way: attackers go after internet-facing enterprise software, and blocking at the edge is no substitute for patching.
What Organizations Should Do
- Audit every vendor connection. List all VPN tunnels, remote support tools, service accounts and API integrations that give suppliers access to your network. Each one should have a named owner, least-privilege access and logging, and you should be able to shut it off quickly when a vendor is breached.
- Restrict and monitor vendor support accounts. Require MFA and just-in-time activation, and give support staff access per ticket, not standing access to all accounts. Alert on vendor-account activity outside approved maintenance windows.
- Report breaches without waiting for the vendor. Under the GDPR the hospital or practice is the data controller. When a key processor reports a ransomware incident, start your own breach assessment and AP notification, and stop relying on assurances that data is "probably" safe.
- Prepare for publication and follow-on fraud. The attackers have threatened to leak the data, so monitor leak sites and prepare patient communications. Warn staff and patients about phishing that uses real treatment details.
- Patch internet-facing systems; don't just filter them. As the PeopleSoft WAF bypass shows, path-based blocking can be beaten. Patch exposed collaboration and ERP platforms quickly, and look for webshells and in-memory implants in web server processes.
- Rehearse running without the vendor. Test downtime procedures for the loss of patient portals, mobile apps and integration platforms, because Dutch providers lost those services for more than a week.
Sources: ChipSoft confirms patient data stolen in 7 April ransomware | How to detect fileless attacks exploiting ToolShell: analyzing the... | ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks | Waarom de zorgsector al jaren de meest gehackte sector van Nederlan... | Chipsoft Hack: Potential Leak of Hospital Patient Data (2026) | Chipsoft Hack: Dutch Hospital Patient Data at Risk? What You Need t... | George van Dijk | What is HiX? Integrating via HL7 and FHIR Isatis