The attack was claimed by the Medusa ransomware gang, which added the organization to its leak site on Saturday. The gang gave PhilHealth 10 days to pay several different ransoms, including $100,000 to extend the ransomware’s deadline and $300,000 to either delete all the stolen data or download it.