Another data leak hits PhilHealth

MANILA, Philippines — Bugs or coding errors, not cyber hackers, caused glitches that hit the Philippine Health Insurance Corp. (PhilHealth)’s website over the weekend, Department of Information and Communications Technology (DICT) Undersecretary for cybersecurity, connectivity and upskilling Jeffrey Ian Dy said yesterday.

The bug, however, has been fixed, according to Dy, as he gave assurance that the PhilHealth website is back to normal.

“It seems that there were some errors made in building the website. They fixed it already. It was a bug,” he told The STAR.

The PhilHealth website had suffered a Medusa ransomware attack perpetrated by cyber hackers in September last year, where the hackers tried to extort $300,000 from PhilHealth.

A Medusa ransomware is a type of malware that encrypts files and demands a ransom payment for the decryption key.

DICT Secretary Ivan John Uy had previously said a report done on the cyber attack showed that the Medusa ransomware attackers had stolen some 600 gigabytes of data from the PhilHealth website.

The National Privacy Commission (NPC) has also taken steps to look into the incident.

“We already informed the quick response team and they will conduct an initial investigation,” NPC public relations officer Kate Lo told The STAR.

Following the development, PhilHealth advised its members who are having problems accessing the member portal to immediately seek assistance from the agency.

Rey Baleña, acting vice president of PhilHealth’s corporate affairs group, said they are ready to help these members having problems in gaining access to PhilHealth’s member data record.

“We can directly assist these members and help check the issue. We will just need their details to be able to help them,” Baleña said in a Viber message.

“Upon checking, the systems are up and running. We don’t have any advisory about issues in our member portal,” he added.

Baleña likewise disclosed that PhilHealth is in constant coordination with the DICT, especially in the former’s digital transformation program.

At a briefing last Friday, PhilHealth assured the public that the hacking incident that affected PhilHealth’s systems last year would not be repeated.

“We