Push Admin

Six out of eight PhilHealth external systems running after ransomware attack

Article (news)

Joyce Balancio, ABS-CBN News

<div class="embed-wrap"><figure data-feedback="fb:likes,fb:comments"><img alt="PhilHealth personnel manually process members’ transactions in Quezon City on September 28, following the shutdown of its online system due to a cyberattack. Maria Tan, ABS-CBN News" src="https://sa.kapamilya.com/absnews/abscbnnews/media/2023/news/10/05/20230926-philhealth-office-mt-6.jpg"/><figcaption>PhilHealth personnel manually process members’ transactions in Quezon City on September 28, following the shutdown of its online system due to a cyberattack. <em>Maria Tan, ABS-CBN News</em></figcaption></figure></div><p>MANILA — Six out of eight external systems of the Philippine Health Insurance Corporation (PhilHealth) that had been affected by a Medusa Ransomware attack were up and running on Thursday, the agency’s spokesperson said. </p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/10/04/23/consumers-must-prepare-for-potential-impact-of-philhealth-breach">Govt must prepare consumers for potential impact of PhilHealth data breach: groups</a></li></ul><p>Dr. Israel Francis Pargas said these include the website, members portal, e-claims portal, electronic premium remittance system, and the electronic PhilHealth acknowledgement receipt.</p><p>“Soon po tonight, we are hoping na mai-out na rin po natin iyong dalawa pang natitirang system natin. So for the external system, hopefully 8/8 na po na gumagana ang ating systems. So, we are up and about na po by tomorrow [Friday],” Pargas told ABS-CBN News.</p><p>“For our internal systems, we are just checking and scanning all our computers and all our systems before po natin i-up just to make sure na lahat po ay free of all these viruses and para po ay ma-contain din po natin ang lahat, kung ano mang attack ang mayroon. But soon, hopefully by next week, all our internal systems are up and ongoing,” he added.</p><p>PhilHealth admitted that it does not disregard the possibility that hackers could have gained access to membership data and records.</p><p>From what has been posted online by the hackers, Pargas noted that most of these documents came from the work stations of PhilHealth employees, some of whom have access to the members&#x27; database. </p><p>“Mayroon po [access] because the 96 work stations, iba-iba. Mayroong nasa records station, mayroong nasa processing station, mayroong nasa clerk. Ang mga empleyado po natin have different access, depende po sa kanilang trabaho, depende po sa ibinibigay na access,” Pargas said.</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/news/10/02/23/philhealth-to-notify-all-individuals-affected-by-data-breach">PhilHealth to notify all individuals affected by data breach</a></li></ul><figure class="op-interactive"><iframe allow="autoplay; fullscreen" frameBorder="0" height="100%" id="ivsplayer01" scrolling="no" src="https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&amp;key=e8c22c015ca9eafa76f1e3edfa03c603&amp;spid=3001339&amp;vid=2818529" width="100%"></iframe></figure><div class="iwantbar">Watch more News on <a href="https://www.iwanttfc.com/#!/browse/Genres/News/tag_id_genres/id_news" target="_blank">iWantTFC</a></div><p>The ABS-CBN Investigative and Research team summarized the contents of a 44 -minute video posted by hackers on the alleged data and information that were taken from the state insurer’s system. </p><p>These include the following:</p><p>• Folder and file names that contain the words “ID”, “plan”, “fin”, and “2023&quot;</p><p>• Rows of more than 7,000 photo IDs</p><p>• Scanned and photographed IDs, such as PhilHealth company IDs, passports, SSS IDs, and senior citizen’s IDs</p><p>• Scanned and photographed copies of IDs and bank cards of three people</p><p>• Various receipts, such as payment for car insurance addressed to PhilHealth and contributions of informal sectors ranging from P1,000 to P5,000</p><p>• PhilHealth administrative files, such as a master list of PhilHealth employee voters in 2004, minutes of the meeting, decisions of the PhilHealth Arbitration Office, and an affidavit of a PhilHealth employee</p><p>• PhilHealth financial files, such as procurement and expenditure data, cash reports, corporate operating budgets, a billing statement, and an authorization letter to debit money to a LandBank account</p><p>• Information in some of the administrative and financial files, including employees’ names</p><p>• Copies of department orders, such as PhilHealth Corporation Order Nos. 2023-0010 and 2023-0037, a PhilHealth memorandum order, and Anti-Red Tape Authority Memorandum Circular No. 2022-05</p><figure class="op-interactive"><iframe allow="autoplay; fullscreen" frameBorder="0" height="100%" id="ivsplayer01" scrolling="no" src="https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&amp;key=e8c22c015ca9eafa76f1e3edfa03c603&amp;spid=3001339&amp;vid=2829751" width="100%"></iframe></figure><div class="iwantbar">Watch more News on <a href="https://www.iwanttfc.com/#!/browse/Genres/News/tag_id_genres/id_news" target="_blank">iWantTFC</a></div><p>PhilHealth said the leaked internal documents would not affect the overall operations of the agency, but might cause “controversy” especially pertaining to records of cases against hospitals and specific medical practitioners. </p><p>“Pwede siya mapag-usapan, iyong mga hospital or pwede mapag-usapan iyong mga doktor na maaaring nakasuhan ng Philhealth kung iyon ang mga data na nandoon,” Pargas said.</p><p>“Iyon po pong personal identifiable information ng members natin or ating empleyado ay pwede magamit for identity theft and pwede magamit siya sa pagbubukas ng accounts o paggamit ng credit cards na pwede pandaraya ang mangyayari,” he added.</p><p>Pargas assured the public that the agency was taking measures to improve its systems, such as procuring additional layers of cybersecurity, among others.</p>

Six out of eight external systems of the PhilHealth that had been affected by a Medusa Ransomware attack are now up and running.

Six out of eight PhilHealth external systems running after ransomware attack

News

Entertainment

Lifestyle

Sports

Metro.Style

More

Traffic

Manila

Horoscope

News

Six out of eight PhilHealth external systems running after ransomware attack

Joyce Balancio,

ABS-CBN News

Published Oct 05, 2023 06:16 PM PHT

Read More:

PhilHealth

Medusa Ransomware

hack

hacking

cyber attack

data

ABS-CBN is the leading media and entertainment company in the Philippines, offering quality content across TV, radio, digital, and film. Committed to public service and promoting Filipino values, ABS-CBN continues to inspire and connect audiences worldwide.

Corporate

Investors

Governance

International Distribution

Corporate

Governance

Investors

International Distribution

NPC Seal of Registration

Privacy Policy

AI Policy

Terms of Service

Advertise with Us

© 2025 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2025 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2025 ABS-CBN Corporation. All Rights Reserved.