# ChipSoft HiX Healthcare EHR Ransomware Attack — Dutch Hospital Infrastructure Disruption

> Ransomware attack on ChipSoft, the vendor behind the HiX electronic patient record system used by 76% of Dutch hospitals, knocked critical healthcare infrastructure offline on April 7, 2026. Z-CERT issued emergency advisory to immediately disconnect VPN connections via the E-Zorg network due to lateral movement risk to 5,000+ healthcare locations. ChipSoft confirmed possible unauthorized access to patient data affecting millions of Dutch citizens.

- **Published:** 2026-04-09T12:00:00Z
- **Last reviewed:** 2026-04-09T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0344
- **ID:** TL-2026-0344
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** Embargo (Russia)
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On April 7, 2026, ChipSoft — the dominant electronic health record (EHR) vendor in the Netherlands — fell victim to a ransomware attack that disrupted healthcare IT infrastructure across the country. ChipSoft develops and operates the HiX (Healthcare Information eXchange) platform, which serves as the central patient data management system for approximately 76% of all Dutch hospitals, as well as many general practitioners and pharmacies.

The attack was first identified when ChipSoft's website (chipsoft.nl and chipsoft.com) went offline on April 7. Z-CERT, the Dutch healthcare sector's computer emergency response team, received notification of the ransomware attack the same day and immediately issued an emergency advisory instructing all healthcare institutions to disconnect their VPN connections to ChipSoft via the E-Zorg network.

The E-Zorg network is the largest independent healthcare network in the Netherlands, physically separated from the public internet, connecting over 5,000 healthcare locations including hospitals, general practitioners, and pharmacies. It is certified under ISO 27001, NEN 7510, and NTA7516 standards. Z-CERT's primary concern was the risk of lateral movement — ransomware potentially spreading from ChipSoft's compromised infrastructure into hospital networks through trusted VPN tunnels within this closed network.

A confidential memo to ChipSoft customers, obtained by Dutch broadcaster NOS, described a 'data incident' involving 'possible unauthorized access.' ChipSoft confirmed it could not rule out that patient records had been viewed or stolen. The attackers reportedly seized secure data and threatened publication or destruction unless a ransom was paid — a classic double extortion tactic.

At least 11 hospitals proactively took their patient portals and systems offline as a precautionary measure. Named affected institutions include Rijnstate Hospital (Arnhem), Antoni van Leeuwenhoek Hospital (Amsterdam), Erasmus MC, Ikazia Hospital, Medisch Spectrum Twente, Ziekenhuisgroep Twente, Franciscus Hospital (Rotterdam), St. Antonius Ziekenhuis, and Frisus MC (Heerenveen). Nine of these 11 hospitals use HiX more extensively for comprehensive record-keeping.

All ChipSoft deployment models were affected: HiX on-premise installations, HiX SaaS cloud deployments, the SaaS Patient Portal, and the GP (general practitioner) cloud tenant. However, some hospitals with locally stored data reported their systems remained functional, and the majority of hospitals continued to use their patient portals.

The incident has significant regulatory implications under GDPR (known as AVG in the Netherlands). ChipSoft operates as a data processor while hospitals serve as data controllers, creating complex liability and notification obligations. The Dutch Data Protection Authority (AP) and the National Cyber Security Centre (NCSC) were coordinated in the response alongside Z-CERT.

As of April 9, 2026, no ransomware group has publicly claimed responsibility for the attack. The initial attack vector has not been disclosed, though the Z-CERT advisory's focus on VPN disconnection suggests concern about compromise of network-level access or supply chain vectors. Forensic investigation remains ongoing.

This incident represents a critical healthcare supply chain attack due to ChipSoft's near-monopoly position in the Dutch hospital market. The concentration of 76% of Dutch hospitals on a single EHR vendor creates systemic risk — a single point of failure that, when exploited, can cascade across the entire national healthcare infrastructure.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery

## Sources

- [Z-CERT Advisory — ChipSoft Ransomware Incident](https://www.z-cert.nl/)
- [The Register — Ransomware knocks Dutch healthcare software vendor offline](https://www.theregister.com/2026/04/08/chipsoft_ransomware/)
- [NL Times — Ransomware attack on company that manages Dutch hospitals patient files](https://nltimes.nl/2026/04/08/ransomware-attack-company-manages-dutch-hospitals-patient-files)
- [DutchNews — Hackers breach software firm handling patients medical records](https://www.dutchnews.nl/2026/04/hackers-breach-software-firm-handling-patients-medical-records/)
- [SC World — Dutch healthcare software vendor ChipSoft hit by ransomware attack](https://www.scworld.com/brief/dutch-healthcare-software-vendor-chipsoft-hit-by-ransomware-attack)
- [myip.foo — ChipSoft Hit by Ransomware: 76% of Dutch Hospitals Rely on This One EPD Vendor](https://myip.foo/blog/chipsoft-ransomware-dutch-hospitals-epd)
- [DataBreaches.net — Dutch healthcare software vendor goes dark after ransomware attack](https://databreaches.net/2026/04/08/nl-dutch-healthcare-software-vendor-goes-dark-after-ransomware-attack/)
- [ioplus.nl — Cyber attack hits Dutch patient records holder ChipSoft](https://ioplus.nl/en/posts/cyber-attack-hits-dutch-patient-records-holder-chipsoft)
- [abit.ee — ChipSoft Ransomware Attack: Dutch Healthcare in the Dark](https://abit.ee/en/cybersecurity/hackers-and-attacks/chipsoft-ransomware-cyberattack-healthcare-netherlands-z-cert-hospitals-en)
- [Rankiteo — ChipSoft Rijnstate Hospital and Antoni van Leeuwenhoek Hospital Ransomware Analysis](https://blog.rankiteo.com/rijst-chi1775637791-chipsoft-rijnstate-hospital-antoni-van-leeuwenhoek-hospital-ransomware-april-2026/)
- [News Brainport — Hospitals on high alert following cyberattack on ChipSoft](https://www.newsbrainport.nl/hospitals-on-high-alert-following-cyberattack-on-chipsoft/)
- [Medical Buyer — ChipSoft reports massive ransomware attack](https://medicalbuyer.co.in/chipsoft-reports-massive-ransomware-attack/)
- [hendryadrian.com — ChipSoft cyberattack disrupts Dutch hospitals](https://www.hendryadrian.com/chipsoft-cyberattack-disrupts-dutch-hospitals/)
- [E-Zorg — Healthcare VPN Network Services](https://ezorg.nl/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0344