Philippines
National
DICT working on 'full restoration' of compromised PhilHealth system
DICT working on 'full restoration' of compromised PhilHealth system
By Sonny Daanoy
At A Glance
- DICT assured the full restoration of security and stability in PhilHealth systems and to safeguarding government systems.
- Upon the wake of the ransomware attack by the Medusa group, the DICT Cybersecurity Bureau's NCERT headed to the PhilHealth head office to "implement critical security measures.
- Based on reports, the Medusa ransomware group demanded USD300,000 from the government and threatened to expose the data online if PhilHealth refused to pay.
The Department of Information and Communications Technology (DICT) on Thursday, Sept. 28 pledged to continue working on the complete restoration of the Philippine Health Insurance Corporation (PhilHealth) system, which was targeted by cybercriminals last week.
Through its Cybersecurity Bureau, DICT assured the "full restoration of security and stability in PhilHealth systems and to safeguarding government systems and infrastructure from malicious cyber threats."
"We shall continue to investigate and monitor the acquired logs from PhilHealth's affected systems," it said.
"An extensive checklist has been prepared by the DICT to benchmark PhilHealth's readiness to get their systems online," it added.
DICT pointed out that the attack was an attempt to illegally access the information of PhilHealth members, the personally identifiable information of PhilHealth employees, and internal memos that were meant to be treated confidentially.
READ:
https://mb.com.ph/2023/9/22/phil-health-paralyzed-by-medusa-ransomware-attack
Upon the wake of the ransomware attack by the Medusa group, the DICT Cybersecurity Bureau's National Computer Emergency Response Team (NCERT) headed to the PhilHealth head office to "implement critical security measures which included the disconnection of workstations from the network, prompt coordination with PhilHealth to gauge the extent of the attack, and collection of relevant logs for thorough analysis."
Based on reports, the Medusa ransomware group demanded USD300,000 from the government and threatened to expose the data online if PhilHealth refused to pay.
READ:
As of Sept. 25, the web services of the country's health insurance corporation are only accessible via internet protocol (IP) addresses and are currently undergoing comprehensive security scanning.
"Efforts to restore the functionality of PhilHealth’s DNS (domain name system) server are underway," DICT said.
Meanwhile, the exact timeline for the complete restoration of the PhilHealth systems remains uncertain.
READ: