PhilHealth: Workstations hit in ransomware attack, but member data unaffected

MANILA, Philippines — The ransomware attack on the system of the Philippine Health Insurance Corp. (PhilHealth) has not affected the servers containing its members’ private information, the state health insurer said Monday. 

PhilHealth officials said in a briefing that only application servers and employee’s workstations were affected by the ransomware attack. 

“Our general PhilHealth membership data were not affected. That’s for sure,” said Eli Santos, executive vice president and chief operating officer of PhilHealth. 

Nelson De Vera, senior manager of PhilHealth’s information technology and management department, said that the membership database, claims, contribution and accreditation information are stored in a separate database unaffected by the cyberattack. 

The state health insurer said that its website, member portal and e-claims submissions have been restored as of Monday morning.

The Department of Information and Communication Technology earlier said that PhilHealth’s website and database had been targeted by Medusa ransomware. The hackers were demanding $300,000 (P17 million) from the government for the return of the data they encrypted.

According to Santos, PhilHealth is taking actions to “strengthen our incident response plan to ensure swift and effective responses to future threats, continuously improve our defenses, stay up to date with the latest threats, and adapt our security measures accordingly.”

The Computer Professionals’ Union earlier said that the ransomware attack shows the government’s “lack of capacity to protect its citizens from cyberattacks against its infrastructure.” — Gaea Katreena Cabico