Cybercriminals who targeted hospitals in New Zealand’s Waikato district have published the stolen patient data to the local media outlets, with the outlets declining to publish the details as health systems struggled to come back online more than a week after the ransomware attack. According to the local media, the leaked data includes official-looking records and documents containing names, phone numbers, and addresses of patients and staff.
The release of the information comes a week after the health system’s information services were entirely shut down by hackers, impacting clinical service, disrupting the treatment of patients and the payroll process of staff members. As a result, hospitals shifted to manual processes to support a backlog of patients while the public was asked to look for alternative avenues for treatment for non-critical conditions.
The breach comes after Ireland’s hospitals suffered a ransomware attack which was quite similar to the Waikato ransomware attack. Officials were forced to shut down many of their computers after hackers secured access to the health service’s systems. Also, hospitals had to cancel services and staff had to rely on pen and paper rather than PCs.
The Federal Bureau of Investigation (FBI) stated this week that the hackers who targeted the Irish hospitals call themselves the ContiLocker Team and use a strain of ransomware known as Conti to break into victims’ machines and extort payments. When Waikato hospitals first had to shut down, the head of New Zealand’s doctors’ association, Deborah Powell, said the attack appeared to be of the same type.
“This is a criminal investigation and we have every confidence that it is being dealt with by NZ Police and cybersecurity experts. Care and safety of patients remain our highest priority, and we must concentrate on health services and supporting our staff to do their job,” Waikato DHB Chief Executive Kevin Snee said in a statement.
Andrew Little, the health minister and the minister responsible for New Zealand’s intelligence agencies, said he could not give anxious patients any assurance that their personal data hadn’t been compromised.
The New Zealand government’s cyber agency refused to comment on the collaboration with Irish authorities regarding the incident. “The NCSC knows from its involvement in other significant cyberattacks that malicious actors can monitor what is being said in the media, and this can influence their behavior,” the National Cyber Security Centre said in a statement.
