PhilHealth spends P14M for new anti-virus system

PhilHealth employees at work in Quezon City. (File photo by GRIG C. MONTEGRANDE / Philippine Daily Inquirer)

MANILA, Philippines — The Philippine Health Insurance Corp. (PhilHealth) is expecting the delivery this week of the P14-million antivirus system it recently procured to provide a wall of protection against various forms of malware attacks, as it continues to determine the extent of data breach that has so far affected up to around 20 million members.

According to Nelson De Vera, PhilHealth’s senior manager for information technology and management department, the new antivirus software to be installed in the PhilHealth system costs around P14 million and would be used for one year.

De Vera assured the public that the new system would be able to bolster defenses against different forms of malware attacks, including ransomware that caused the leak of more than 730 gigabytes (GB) of sensitive information.

This does not mean, however, that the state insurer’s system would now become impenetrable as hackers are always “one step ahead,” he noted.

“It would be unwise to say that [it would be] foolproof once we implement the changes. Remember, these hackers know no rules, while we play by the rules,” De Vera told a press briefing. What PhilHealth can do is “increase security posture and augment security solutions to minimize risk of this happening again,” he added.

Still figuring it out

PhilHealth data privacy officer Nerissa Santiago noted that the state insurer is still analyzing the extent of ransomware attack carried out by Medusa group, but she estimated that the information of around 13 to 20 million members were stolen.

According to Santiago, PhilHealth is looking at multiple options for notifying affected members: through text message, e-mail or in-person visits. The state insurer is also set to create a verification portal—separate from the existing one made by National Privacy Commissioners—so members could check whether their sensitive data was compromised.

“With regard to the notification … this consists of [more than] 700 GB of data and it’s taking us a bit of time to analyze because of the volume of data,” she said, adding that the state insurer is also cleansing the affected data of possible duplicates. PhilHealth personnel whose workstations had been affected by the data leak had been alerted through “notification letters.”

President and CEO Emmanuel Ledesma Jr. said that the restoration of its front-line and back-end systems are “85 percent complete,” with the utility systems targeted to be brought back by the end of the month.

In the same press conference, Santiago, who also serves as vice president for the Office of the Actuary and PhilHealth chief operating officer Eli Santos denied allegations of “incompetence and gross negligence” in the performance of their duties that prompted Health Secretary Teodoro Herbosa to request their reassignment due to “loss of confidence.”

They were alluding to an Oct. 16 memorandum of the Commission on Elections that granted the request by Herbosa, who sits as ex-officio PhilHealth board chair, to “transfer or detail officers and employees” of the state insurer from Aug. 29 to Nov. 29 this year amid the ban against such move under the Omnibus Election Code.