PhilHealth Medusa ransomware attack

On 22 September 2023, the Medusa ransomware gang struck the Philippine Health Insurance Corporation (PhilHealth), the government-owned agency that administers universal health coverage for the Philippines. The attack encrypted internal systems, knocked member-facing services offline, and exfiltrated roughly 750 GB of highly sensitive data.

What happened

Medusa is a financially-motivated ransomware-and-extortion operation. After breaching PhilHealth's network, the gang deployed ransomware and stole a massive trove of records before demanding a $300,000 ransom — equivalent to about 17 million Philippine pesos — in exchange for a decryption key and a promise to delete the stolen data.

A subsequent investigation revealed a striking root cause: at the time of the attack, PhilHealth's systems were not protected by antivirus software because the licence had expired and renewal had been delayed by government procurement procedures.

Data exposed

The roughly 750 GB of exfiltrated data included some of the most sensitive categories of personal information a government holds:

• Patient medical case files and records
• Member billing records and identifiers
• Records of rebel returnees under the PAMANA programme
• Member records of persons with disabilities (PWD) showing passwords
• Indigent and senior-citizen billing records
• "Killed in action" and "killed in operation" records

Later reporting indicated the breach may have affected up to 42 million people.

Ransom standoff

The Philippine government, coordinating through the Department of Information and Communications Technology (DICT), publicly refused to pay the ransom, citing both policy against funding criminals and uncertainty that payment would protect victims. When the deadline passed in early October 2023, Medusa began publishing the stolen data on the dark web.

Impact and response

The leak exposed millions of Filipinos — including medical patients and vulnerable groups — to identity theft, extortion and fraud. The National Privacy Commission opened an investigation, and PhilHealth urged members to monitor their accounts and remain alert to phishing. The incident became a national scandal over the state of cybersecurity in Philippine government agencies.

Why it matters

The PhilHealth breach is the Philippines' defining healthcare-sector incident. An expired antivirus licence — a basic, preventable lapse — left a national health insurer's most sensitive records open to a ransomware gang. It exposed chronic underinvestment and procurement-driven delays in government cybersecurity, and it reinforced, at national scale, the principle that critical public-sector data demands sustained, well-funded protection.