Ethiopia’s Health Ministry Faces Unverified DHIS2 Data Leak Claim

A hacker posted on an underground forum this week. The person claims to share files from Ethiopia’s Federal Ministry of Health. The post says the data comes from the country’s Health Management Information System, known as HMIS. However, no one has proven that this claim is true yet.

A report from the Dark Web Intelligence account on X shared details about the listing. The post reportedly includes a database file, a smaller zipped archive, and a banner image. Still, key proof is missing, and the claim remains unverified for now.

The Claim Behind the Alleged Leak

The hacker’s post names a file called “hmis_custom_backup.dump.” The actor describes this file as a 6GB PostgreSQL database backup. According to the post, this file could grow to 65GB once someone restores it fully.

The listing also mentions a second file, “dhis_database.zip.” This archive reportedly weighs 0.5GB in its compressed form. The actor claims it expands to 6GB once someone unpacks the cleaned CSV tables inside it.

The post reportedly shows a defacement-style banner image too. It also includes a request for donations. The actor hints that more leaks could follow this one soon. However, the screenshot does not show a list of database tables. It also skips sample records that anyone could check. Without these details, nobody can confirm what the files truly contain.

The file names point toward DHIS2, a health platform Ethiopia uses nationwide. Still, file names alone cannot prove where data came from. They also cannot confirm if a file is authentic or complete.

What DHIS2 Normally Stores for Ethiopia

Ethiopia’s Ministry of Health confirms on its own website that it uses DHIS2 to collect health data. The ministry also uses this system to study health trends across the country.

DHIS2’s official documentation explains how health teams use the platform. Workers use it to track routine reports and monitor hospital and clinic services. Officials also use it to guide public health decisions nationwide.

Most DHIS2 systems store general health numbers. These numbers often cover topics like service counts and facility performance. They rarely name a single patient directly in these summary reports.

Even so, DHIS2 can store more personal data too. Some modules track individual patients during treatment or disease monitoring. The type of data stored depends on how each country sets up its system. This detail matters a lot for this case. The leaked files might only hold general health statistics. On the other hand, they could hold more sensitive patient details instead.

Nobody can say which type of data these files hold right now. The PostgreSQL format matches a normal database export style. That alone, though, does not link the files to Ethiopia’s health ministry.

DHIS2’s setup documentation also explains how these systems get built from the start. The documentation shows how complex a full verification process would need to be. Simply reading file names cannot replace that kind of checking.

No Confirmation Yet From the Ministry

Searches for the exact file names did not turn up other news reports. No outlet so far has confirmed this specific leak happened. Another report about alleged data theft from a government institution concerns a French-confirmed cyberattack on the environment ministry, where a hacker claims to have stolen data. The ministry has not issued a public statement about it either.

Nobody has confirmed whether the files truly came from the ministry’s own systems. Nobody has confirmed whether someone successfully downloaded and opened these files. Both questions remain open until real proof appears.

The hacker’s hint about future leaks raises fresh questions too. A threat to share more data is not proof itself. It does not confirm that any stolen data truly exists. Until solid evidence shows up, people should treat this as a claim only. It is not yet a confirmed breach of Ethiopia’s Ministry of Health. Anyone judging the risk should wait for real proof first.

Ethiopia also lists other digital health systems on its ministry website. These systems support the country’s wider digital health goals. A confirmed breach could affect more than one of these tools.

Readers should also check for updates from Ethiopian authorities soon. A national cybersecurity body may comment on this case later. Until then, words like “alleged” and “unverified” still apply here. Stolen or leaked data often spreads across private forums first. Buyers and researchers trade such files before wider proof appears. That pattern alone does not confirm this specific claim is true.

For now, this story stands as an unverified leak claim. It is not a confirmed cyberattack on Ethiopia’s health ministry. Readers should watch for an official statement before drawing firm conclusions.