PhilHealth blames cyberattack on outdated software

The outdated system protection software of the Philippine Health Insurance Corporation, or PhilHealth, may have opened the gateway to the Medusa ransomware group that hacked its system, a ranking official said Monday.

PhilHealth EVP and COO Eli Dino Santos bared this in a press briefing over a week after the state-run health insurer announced that its online system had been attacked by a computer hacking group called Medusa.

According to Santos, before the incident, PhilHealth had its antivirus software that could address cyber threats. It was, however, not updated due to what he described as "procurement issues."

"The answer is yes, we have an anti-virus [software] in general, but it was not updated. Probably that's where the hackers came in. Probably through that weakness," he said.

"But at that time there were procurement issues. For me, the reason was the strict compliance with procurement rules and regulations," he added.

Santos explained that the state-run health insurer was about to renew its subscription with its current third-party software provider, but the Government Procurement Policy Board approved the inclusion of online subscriptions under negotiated procurement-direct retail purchases.

"We were affected by the recent issuance of the GPBB because we were set to renew our subscription licenses for an antivirus for another year," he said.

"That is why we were not able to update the system. Just to be clear about it, there is still an antivirus system. It is just that it was not updated due to the procurement system," he added.

PhilHealth announced on 22 September the shutdown of its website, as well as its PhilHealth membership portal, to contain an "information security incident."

In the following days, the Medusa ransomware group demanded $300,000 or around P17,000,000 from PhilHealth in exchange for access to its own system.

The group had given the health insurer 10 days to comply, or it said it would leak the personal information of PhilHealth members.

Today is the last day for PhilHealth to give in to the hackers' demand.