ChipSoft Ransomware Attack Causes Widespread EHR Outages in Dutch and Belgian Hospitals

The Dutch healthcare IT company ChipSoft has been affected by a ransomware attack that forced it to take critical services offline, disrupting access for hospitals, healthcare professionals, and patients across the Netherlands and Belgium.

ChipSoft, one of the Netherlands’ leading providers of electronic health record (EHR) systems, confirmed the cyberattack after disabling its website and several digital platforms as a precautionary measure. EHR systems store and manage patients’ medical histories digitally and are essential to day‑to‑day healthcare operations. The incident primarily impacted ChipSoft’s flagship HiX platform, which is widely deployed in Dutch hospitals, with users reporting service outages earlier this week.

The ransomware attack occurred on April 7, prompting close coordination between ChipSoft, affected healthcare organizations, and the Dutch healthcare computer emergency response team Z‑CERT. As part of the immediate response, access to critical services including Zorgportaal, HiX Mobile, and Zorgplatform was temporarily disabled. ChipSoft has since begun restoring systems in phases and issuing new login credentials to users.

According to Z‑CERT, the impact on hospitals has largely been logistical rather than clinical. Institutions experienced increased call volumes and the need for additional support staff, but no critical medical services were interrupted. Z‑CERT continues to assist by offering technical guidance, monitoring developments, and supporting detection, response, and recovery efforts to limit the overall impact of the incident.

“As previously reported, software vendor ChipSoft was hit by a ransomware attack on Tuesday, April 7,” Z‑CERT stated. “Since then, Z‑CERT has maintained continuous contact with ChipSoft, healthcare institutions, and other stakeholders to closely monitor the situation and provide appropriate support.”

Z‑CERT added that ChipSoft is communicating directly with its customers and outlining recommended actions. All connections to Zorgportaal, HiX Mobile, and the Zorgplatform were disabled as a preventive measure and remain unavailable while systems are cautiously brought back online. The restoration process is being carried out in stages, during which users receive new credentials. Z‑CERT continues to track the situation and will notify participants if further updates are warranted.

Dutch media outlets confirmed the cyberattack, citing an internal memo that warned of potential unauthorized access. ChipSoft reportedly advised healthcare providers to disconnect from its systems until remediation and cleanup efforts are fully completed, while the company works to contain the incident and minimize disruption.

Several hospitals, including those in Roermond and Weert, shut down their patient portals following the attack, temporarily preventing access to medical records and appointment information. While patient care continued, hospital staff assisted patients manually due to system limitations. Other hospitals reported limited or no impact and continued to monitor their environments.

According to Dutch broadcaster NOS, most hospitals kept their patient portals online. However, a survey found that 11 hospitals temporarily disabled access, at least nine of which were more tightly integrated with ChipSoft systems than most others.

The incident also had cross‑border consequences. Patient portals at several hospitals in Belgium were taken offline, highlighting how shared healthcare IT providers can amplify the impact of cyber incidents. Belgian media reported that the disruption affected facilities including Hospital aan de Stroom in Antwerp, Hospital Oost‑Limburg, and Delta Hospital in Roeselare. Belgian outlet AA linked these outages directly to the ransomware attack on ChipSoft, which supplies electronic patient record systems and healthcare platforms to organizations in both countries.

Cyberattacks against healthcare IT vendors are particularly damaging because these companies serve as centralized service hubs for many hospitals and clinics. A compromise affecting one provider can ripple across multiple healthcare organizations simultaneously, dramatically increasing operational impact. These platforms also store large volumes of highly sensitive data—such as medical records, personal details, and billing information that can be exploited for extortion, fraud, or resale.

Moreover, healthcare services depend heavily on system availability. Any disruption can interfere with patient care and create urgency for rapid restoration, increasing pressure on victims and making healthcare organizations especially attractive targets for ransomware operators seeking financial gain.