Ransomware Hits IT Firm Used by Dutch Hospitals


Ransomware attack hits ChipSoft, the IT provider used by most Dutch hospitals, raising concerns over possible patient data exposure.

A ransomware attack has struck ChipSoft, a major Dutch healthcare IT provider whose systems are used by a large share of hospitals in the Netherlands.

The company supplies software platforms that hospitals and general practitioners use to manage electronic patient records and internal healthcare processes. The systems are used by roughly 70% of Dutch hospitals, making the incident a significant concern for the country’s healthcare infrastructure.

Cybersecurity organization Z-Cert, which focuses on protecting healthcare systems in the Netherlands, alerted medical institutions about the incident and advised them to take precautionary measures. Hospitals were urged to disconnect their VPN connections to ChipSoft and closely monitor network activity while the situation is investigated.

ChipSoft confirmed the incident, describing it as a “data incident” involving possible unauthorized access. The company said it cannot yet rule out the possibility that patient information may have been accessed or stolen, though the full impact remains under investigation.

Several hospitals that use ChipSoft’s systems have said they have not experienced disruptions so far. Institutions including Rijnstate Hospital in Arnhem, Frisus MC in Heerenveen, and the Antoni van Leeuwenhoek Hospital in Amsterdam reported that their patient data appears to remain secure and healthcare services continue to operate normally.

Experts say one of the main concerns involves patient portals, the online systems that allow patients to access medical records and communicate with healthcare providers. If attackers gain access to these systems, sensitive medical information could potentially be exposed.

Authorities have not yet revealed which ransomware group may be responsible, and investigations into the breach are ongoing. Healthcare institutions across the Netherlands are continuing to monitor their systems while security teams assess the extent of the attack.


Reports are sourced from official documents, law-enforcement updates, and credible investigations.

Discover additional reports, market trends, crime analysis and Harm Reduction articles on DarkDotWeb to stay informed about the latest dark web operations.