PhilHealth says data of 13m to 20m members now on dark web

The data of some 13 million to 20 million members of the Philippine Health Insurance Corp. (PhilHealth) were leaked to the dark web, the government firm’s Data Privacy Officer Nerissa Santiago said Wednesday.

“For the members, if we’re talking about the local workstation, we’re expecting a total of 13 [million] to 20 million names,” Santiago said.

PhilHealth employees’ workstations and application servers were breached in a Medusa ransomware attack last Sept. 22.

Santiago said PhilHealth has yet to begin notifying members affected due to the massive size of the data it is currently analyzing.

“This consists of about 700 [gigabytes] of data, and it’s taking us a bit of time to analyze because of the volume of data,” she said.

“As for the 13 million members, we are still in the process of analyzing it,” Santiago added.

Earlier, AnaKalusugan party-list Rep. Ray Reyes chided PhilHealth for its failure to update its anti-virus protection.

“Is this just a trial version? It’s been months since the data breach was first reported and their solution to this was an anti-virus software with a one-month subscription?” Reyes said.

“The expiry of the anti-virus software is on you. Way before it expired, you could have done what was needed to ensure data protection,” he added.