Dutch healthcare software vendor goes dark after ransomware attack

What happened

A major Dutch healthcare software supplier was knocked offline after a ransomware attack. ChipSoft’s public website went dark on April 7 and, it has been reported that, remains unreachable; emails for the company are still functioning. It has been reported that Z‑CERT, the Netherlands’ healthcare computer emergency response team, received notification of the incident and said the attack included a ransomware element.

Immediate impact

The disruption has not been uniformly catastrophic — most hospitals served by ChipSoft can still access patient portals — but it's a messy, uneven picture. Only 11 hospitals have pulled the software entirely offline and, it has been reported that, nine of those are among the facilities that use ChipSoft more comprehensively. What happens when the system that holds patient records stumbles? Patients and staff feel it fast. Digital outages are not abstract. They can delay care and fray nerves.

Response

Z‑CERT says it is in contact with ChipSoft, affected healthcare institutions and partners, and is urging operators to audit systems for unusual traffic and report suspicions through its incident line. The identity of the attacker remains unknown and the company has been contacted for comment. It has been reported that hospitals and vendors are scrambling to follow disaster‑recovery playbooks — if they have them — while forensic work proceeds.

Bigger picture

This is part of a broader, ugly trend. It has been reported that Z‑CERT singled out ransomware and extortion as the top threats to Dutch healthcare in its annual landscape report. Dutch healthcare has been stung before: the 2025 Nova/Eurofins strike leaked nearly a million patient records, and a January 2026 ransomware hit on Belgian network AZ Monica forced ambulance diversions and postponed operations. “Digital outage is not an abstract IT problem. It concerns people who need care,” said Z‑CERT director Wim Hafkamp — a sober reminder that this is about more than servers and ransom notes.

Sources: The Register