ChipSoft HiX Ransomware Vendor Says Data Theft Was Confined to Its Hosted Tier

ChipSoft detected system anomalies on April 7, 2026. The company informed customers of an incident. It did not characterise it publicly as ransomware, and its corporate website was still offline the following morning.

Z-CERT supplied the characterisation ChipSoft would not. In a bulletin to care institutions on April 8, reported by NOS, Z-CERT confirmed ransomware and advised hospitals to sever VPN connectivity to ChipSoft immediately. Hospitals complied and went further, pulling patient-facing services offline as a precaution. Slingeland Ziekenhuis in Doetinchem, Diakonessenhuis in Utrecht, Rijnstate in Arnhem and Tergooi MC all published notices.

Tergooi disabled mijn.tergooi.nl along with its integrations to BeterDichtbij, Luscii, Sananet and Gezondheidsmeter, leaving patients unable to log in, view results, book or change appointments, or check in online. Tergooi also reported that the self-service check-in kiosks in the hospital had stopped working.

What did not happen matters as much as what did. Slingeland stated plainly: "De zorg voor onze patiënten gaat onverminderd door en patiëntendossiers blijven intern volledig toegankelijk" - care for our patients continues undiminished and patient records remain fully accessible internally. Rijnstate reported "Op dit moment ervaren wij geen verstoringen in ons systeem" - at this time we are experiencing no disruptions in our system. The portals went dark. The wards did not.

This was a patient-facing availability event and a confidentiality event, not a clinical continuity event, and the distinction should not be blurred.

The confidentiality picture then deteriorated in stages. ChipSoft's early message, relayed by Slingeland, was that "patiëntgegevens naar alle waarschijnlijkheid niet betrokken zijn bij het incident" - patient data was in all likelihood not involved. On April 15, NOS reported that sources inside and outside ChipSoft no longer excluded a data leak. On April 16, ChipSoft confirmed the theft outright. CEO Hans Mulder: "Na veertig jaar toewijding aan betrouwbare zorg-ICT doet het ons pijn dat deze situatie is ontstaan.

" After forty years of dedication to reliable healthcare ICT it pains us that this situation has arisen. This removal of data we cannot undo.

Downstream disclosures followed through late April. De Forensische Zorgspecialisten, operator of De Waag and the Van der Hoeven Kliniek, reported theft affecting approximately 6,000 forensic care clients, with a spokesperson describing the data as "persoonsgegevens zoals voor- en achternaam en geboortedatum" - personal data such as first and last name and date of birth. The Rotterdam Eye Hospital reported theft.

Huisartsenpunt, a GP cooperative running four practices in Limburg at Grathem, Heel, Ittervoort and Vlodrop, reported theft and told patients it was not yet clear which personal data was involved. ChipSoft set up a service line for affected patients and made specialised lawyers available to speak with them. Hospitals began restoring digital access in the final days of April, with Diakonessenhuis, Meander MC and Martini Ziekenhuis back online and data exchange resuming between OLVG Amsterdam and UMC Utrecht by April 30.

The single most useful claim in this incident is a negative one. According to ChipSoft, not every HiX customer lost data. The company's spokesperson drew the line precisely: "Instellingen die de software van ChipSoft in eigen beheer uitvoeren of door derden laten beheren, zijn niet getroffen." Institutions that run ChipSoft's software under their own management, or have it managed by third parties, were not affected. The spokesperson confirmed that the affected parties were customers of the HiX 365 platform.

Same vendor. Same product family. Same codebase. Two deployment models, and only one of them lost patient data.

One caution belongs on that finding before anything is built on it. The claim is ChipSoft's own, made by its spokesperson about its own product on April 16, while the company was still describing its investigation as ongoing. It has not been independently verified by Z-CERT, the NCSC or the Autoriteit Persoonsgegevens. The same company's previous reassurance, that patient data was in all likelihood not involved, survived nine days before collapsing.

No self-hosted victim has surfaced and the architecture reasoning below holds on its own terms, but the negative is a vendor assertion rather than an established fact and should be read as one.

On that basis, this is not a story about a vulnerability in HiX. No CVE has been published, and there is no indication in any retrieved source that the software itself was the entry point. It is a story about where the data was sitting and who was responsible for the perimeter around it. Customers who kept HiX in their own data centres, or contracted a third party to run it, retained control of their own attack surface and their own blast radius. When ChipSoft's hosted environment was compromised, those customers had nothing in it to lose.

Customers who moved to HiX 365 had transferred operation of that perimeter to the vendor. The compromise of one vendor environment was therefore the compromise of all of them at once.

The architecture decision was the security outcome. Every self-hosted customer had, without necessarily framing it as a security control, retained an isolation boundary that the hosted customers had traded away for operational convenience. That trade is legitimate and often correct: most healthcare providers cannot staff a 24/7 security operations centre, and a competent vendor genuinely does run infrastructure better than a 200-bed hospital's four-person IT team. The point is not that hosted is wrong.

The point is that the trade converts many independent, uncorrelated risks into one shared, perfectly correlated one, and almost nobody prices that correlation when signing the contract.

Concentration is what turns a single vendor's bad week into a national event. At 76 percent of Dutch hospitals by the M&I/Partners count, ChipSoft is not one supplier among several. Z-CERT's containment advice illustrates the dependency directly: the recommended action was for hospitals to cut their VPN connections to ChipSoft, which is only a meaningful instruction because essentially every hospital has one.

The blast radius extended past hospitals into primary and specialist care. GP practices, rehabilitation clinics, forensic psychiatric institutions and a specialist eye hospital all appeared in the disclosure sequence. These are organisations with no meaningful relationship to one another, in different care sectors, under different governance, sharing nothing except a hosting provider. That is the defining signature of concentration risk: the correlation between victims is invisible on any org chart and only appears in the supplier register.

The Dutch state noticed. On April 21, 2026, in written answers to parliamentary questions, health minister Sterk said ChipSoft must take full responsibility as a supplier, and framed the broader issue in terms of digital autonomy, arguing that care providers must have insight into vulnerabilities and must make deliberate choices about dependence on dominant market parties.

The market context sharpens the point. On the same day, the Gerechtshof Arnhem-Leeuwarden ruled against ChipSoft in its challenge to UMCG's plan to extend its Epic electronic patient record to Treant and Ommelander Ziekenhuis Groningen without a fresh European tender. The appeals court found it significant that UMCG's 2015 procurement had already contemplated an EHR to which other hospitals could connect. UMCG said it was extremely pleased the court confirmed the regional collaboration could proceed. A separate civil case between ChipSoft and UMCG remains pending in Groningen.

A dominant vendor litigating to constrain a competitor's regional expansion, in the same month a compromise of its hosted platform hit customers across four care sectors, is the concentration problem stated twice in one week.

No formal technical attribution has been issued by ChipSoft, Z-CERT or the NCSC, and no entry vector has been published.

A group operating under the name Embargo claimed responsibility. On or about April 20, 2026, described by NOS only as "begin deze week", it posted a message on a darkweb leak site claiming to hold 100 GB of ChipSoft data, accompanied by two countdown timers due to expire that week. Harm Teunis, security researcher at ESET, quoted by NOS, described the mechanism plainly: "Die klok is erop gericht om hun slachtoffers onder druk te zetten" - that clock is aimed at putting their victims under pressure.

The pattern is standard double extortion, encryption for disruption plus exfiltration for leverage.

The listing was subsequently withdrawn. ChipSoft confirmed at the time that negotiations with the criminals were under way, declining to say more: "Ter bescherming van de belangen van alle betrokkenen kunnen wij op dit moment geen verdere uitspraken doen" - to protect the interests of all involved we can make no further statements at this time. On April 28 ChipSoft announced that publication had been prevented and the stolen data destroyed: "Mede met ondersteuning van cybersecurity-experts is het ons gelukt om te voorkomen dat de gegevens gepubliceerd zijn.

" The company added that "onze cybersecurity-experts hebben bevestigd dat deze vernietiging op technisch juiste wijze heeft plaatsgevonden" - our cybersecurity experts have confirmed that this destruction took place in a technically correct manner.

ChipSoft has not disclosed whether it paid, has not explained how destruction was verified, and has not excluded the possibility that copies were retained. Teunis noted that withdrawal of a leak-site threat often follows payment, though it can also be a negotiating move. A criminal's assurance that it deleted its only leverage is not evidence, and no independent verification exists.

The LHV, the Dutch national GP association, issued balanced guidance on May 1. It relayed Z-CERT's assessment that publication of the data "inderdaad minder waarschijnlijk lijkt" - indeed appears less likely - and told GPs they may tell patients "dat het risico kleiner is", that the risk is smaller. In the same guidance it told practices not to say that everything is safe or that the risk has passed, warning that it cannot be excluded that something happened with the data earlier or that something will happen with it in future.

• Medical treatment information. A single anonymous source told de Volkskrant, in reporting relayed by NOS, that the attackers were specifically looking for medical information about treatments. This is special category data under GDPR Article 9, and the claim rests on one unnamed source
• Patient names, first and last, and dates of birth, per De Forensische Zorgspecialisten
• The fact of association with forensic psychiatric care for approximately 6,000 clients of De Waag and the Van der Hoeven Kliniek. No source establishes that clinical content was taken from these institutions; the confirmed data classes are name and date of birth. The association alone is sensitive irrespective of clinical content, and carries stigma and legal consequence that no reissue can undo
• Ophthalmology patient data from the Rotterdam Eye Hospital
• GP practice patient data, including four Limburg practices under Huisartsenpunt
• Rehabilitation clinic patient data

Data class matters here for a reason that outlives the incident. A password is revoked in seconds. A diagnosis is permanent. Facts about psychiatric treatment, forensic care and ophthalmic conditions cannot be rotated, reissued or invalidated, and their sensitivity does not decay on any schedule.