The Philippine Health Insurance Corp. (PhilHealth) has implemented security containment measures after a system breach was detected due to a cyberattack on Friday, Sept. 22.

The state health insurer implemented measures such as disabling its website, healthcare institutions (HCI) and member portal, and e-claims.

“We are working to restore these systems on Monday, Sept. 25,” PhilHealth’s statement read, adding that it is working closely with the Department of Information and Communication Technology (DICT), National Privacy Commission (NPC), Cybercrime Units of the National Bureau of Investigation (NBI), and the Philippine National Police (PNP) to resolve the issue.

Hackers demand $300k for data leak

The DICT confirmed on Sunday, Sept. 24, that the Medusa ransomware helmed the attack against PhilHealth’s website “by exploiting publicly exposed Remote Desktop Protocol (RDP) servers either through brute force attacks, phishing campaigns, or exploitation of existing vulnerabilities.”

The hackers demanded $300,000 or equivalent to P17,033,550 to delete the data they obtained, the Philippine Star reported.

The agency also told the newspaper that they would give the key to the encrypted data as an exchange for the ransom money.

“They have already made a demand for $300,000 [...] They would give us the key so we can decrypt the data that they encrypted,” DICT Undersecretary Jeffrey Ian Dy said, adding that the leaked data has been exposed on the dark web.

In the same post, DICT called on the public and every government agency to read through their technical advisory for further details regarding the ransomware and implement particular measures “to prevent the said ransomware from accessing systems and devices.”