PhilHealth, the state health insurer, confirmed a recent ransomware attack, revealing that their antivirus subscription had lapsed, leaving them vulnerable. The attack forced PhilHealth to disable its system temporarily as a security precaution.
ICYMI: PhilHealth Targeted by Ransomware Attack
In a report by Mark Salazar on “24 Oras,” PhilHealth acknowledged that their antivirus software had expired on April 15, 2023. Due to complex government procurement procedures, they couldn’t renew the subscription immediately. They have, however, implemented temporary antivirus software.
The ransomware attack, named Medusa, struck PhilHealth on September 22, resulting in a temporary shutdown of their online systems. Hackers demanded a $300,000 ransom, threatening to expose stolen data from their database. PhilHealth firmly stated they would not comply with the demand.
The cyberattack impacted the application server and approximately 72 employees’ workstations.
PhilHealth later regained control of its system without paying the ransom over the weekend. The Department of Information and Communications Technology (DICT) encouraged PhilHealth employees and members to change their passwords for online accounts.
How to Secure Data After PhilHealth Ransomware Attack
Moreover, PhilHealth advised the public to enable multi-factor authentication, be vigilant about suspicious activities in their online accounts, and avoid interacting with suspicious emails, links, or calls.
The DICT confirmed millions were affected by the data breach and highlighted a budget reduction due to the attack—from PHP1 billion in 2022 to PHP600 million in 2023, and a proposed budget of only PHP300 million for 2024.
