AnaKalusugan Party-list Rep. Ray Reyes (Facebook)

AnaKalusugan Party-list Rep. Ray Reyes says the Philippine Health Insurance Corp. (PhilHealth) ought to be held liable for the data breach that resulted from last month Medusa ransomware attack. 

"Dapat may managot sa nangyaring hacking at data leak sa PhilHealth. They should quit their posts if they can't competently follow guidelines that were meant to ensure integrity in government transactions," said Reyes. 

(Someone should be held accountable for the hacking and data leak at PhilHealth.) 

PhilHealth recently revealed that some of their data may have been compromised following the Medusa ransomware attack. Government procurement rules were blamed for the failure to update an outdated cybersecurity system, which allowed hackers to gain access. 

"Blaming the procurement rules just shows a failure of leadership in PhilHealth and the lack of importance they place in protecting members' data,” Reyes said. 

He added that antivirus software are subscription-based and can be easily procured with basic planning and management. 

The AnaKalusugan solon also blasted PhilHealth for its lack of transparency and its conflicting statements regarding the breach. 

“Sa simula sinabi nila na walang data leak hanggang sa umabot na tayo sa ganito. Hanggang ngayon malabo at walang kasiguruhan ang mga statements na inilalabas nila," he said. 

(At the start, they said there was no data leak up until we got to this point. Until now, the statements they are releasing are vague and uncertain.) 

Reyes said that while PhilHealth’s system and database were once again secured thanks to  the Department of Information and Communications Technology (DICT), the main concern lies in the compromised data. 

"Hindi na po natin mababawi o mabubura ang mga bagay na nakapost sa internet at dahil sa malaking kapabayaan na ito ng PhilHealth, di malayong magamit ng mga masasamang loob ang personal information ng mga PhilHealth members sa mga ilegal na gawain," he added. 

(We will no longer be able to recover or delete things posted on the Internet and due to this great negligence of PhilHealth, it is possible that people with bad intentions will be able to use personal information of PhilHealth members in illegal activities.) 

According to PhilHealth, the number of subjects or records affected by the breach has yet to be determined. However, the members' names, addresses, dates of birth, sex, phone numbers, and PhilHealth identification numbers may have been compromised. 

The DICT reported that personal information about the state health insurer’s members and employees are now being leaked on the dark web.