Manila Bulletin Tech editor, Art Samaniego, pretty much covered this on-going ransomware attack on the Philippine Health Insurance Commission (PhilHealth/PHIC). The government agencies involved in the investigation have their jobs cut out for them. The public deserves to know HOW this happened, which is important for other government agencies to learn from, and what the general public needs to do.
I will not go into details of what ransomware infected PHIC, as Art already wrote about it in at least two articles here and here on Manila Bulletin. According to Art, the government is not bent on paying the ransom, even if the malicious actors already posted proof of the data they exfiltrated.
Some questions for PHIC - are our data encrypted? If so, why were the malicious actors able to decrypt it? Did PHIC Data Protection Officer require PHIC member data to be encrypted at all times? What the hell happened, really?! Every organization needs to learn from this incident and hope it never happens to them.
What does it mean to the general public? Well, our medical data, and those of our dependents, are at risk of being sold on the dark web. Imagine, anyone, besides Facebook and Google, getting access to your medical data for a fee. The "harmless" direct effect of this is that pharmaceutical companies can get access to your data and directly target you with ads. There are, of course, more diabolical effects that come with having access to your medical information, specially when you are being targeted because of your profession, e.g. politician, journalist, judges, etc. Scary stuff!
Whilst the personal information of PHIC members probably have been out in the public for quite some time already (thank COMELEAKS for this), the super sensitive medical data being out there is worse in so many levels. What is there left to do, but cringe? Poor Filipinos.