Ransomware Attack on ChipSoft Disrupts EHR Services Across Dutch and Belgian Hospitals On April 7, 2026, Dutch healthcare IT provider ChipSoft suffered a ransomware attack that forced the shutdown of its HiX platform and associated digital services, disrupting electronic health record (EHR) access for hospitals, healthcare providers, and patients in the Netherlands and Belgium. ChipSoft, a major supplier of EHR systems, took its website and key services including Zorgportaal, HiX Mobile, and Zorgplatform offline as a precaution. The Dutch CERT, Z-CERT, has been coordinating with the company and affected institutions to manage the fallout. While critical care services remained operational, hospitals reported logistical challenges, such as increased call volumes and the need for additional support staff. Systems are now being restored in phases, with users receiving new login credentials. At least 11 Dutch hospitals, including those in Roermond and Weert, temporarily closed patient portals, limiting access to medical records and appointments. Most facilities maintained care through manual processes. In Belgium, hospitals in Antwerp, Limburg, and Roeselare also experienced outages due to their reliance on ChipSoft’s systems. The incident underscores the high-risk nature of attacks on healthcare IT providers, which serve as centralized hubs for multiple organizations. By targeting a single vendor, threat actors can disrupt operations across numerous hospitals, leveraging the urgency of healthcare services to pressure victims into paying ransoms. The attack highlights vulnerabilities in shared infrastructure and the cross-border impact of such breaches.