Information System Outage and Cyber Security Latest

Home ›... Information System Outage and Cyber Security Latest
IT Outage and Privacy

Information System Outage and Cyber Security Latest

Waikato DHB Ransomware Incident

Information System Outage and Cyber Security Update

Waikato DHB hospital services have returned to full functionality following the cyber security incident which affected our systems in May 2021. Waikato DHB has also now completed its forensic investigation into the cyber security incident and notified all individuals whose personal information was impacted by the incident.

We thank our people, the community we support, and our partners and regulators for their patience and support while we worked through our response to this incident.

Forensic Investigation

Upon becoming aware of a system outage last year, Waikato DHB immediately engaged external cyber security experts to contain and investigate the incident. With the assistance of these experts, Waikato DHB took steps to secure and restore our digital systems as quickly as possible. Waikato DHB hospital services have since returned to full functionality.

Expert forensic investigators have now finalised their investigation into the incident, following a lengthy review of forensic evidence from Waikato DHB’s impacted systems. The findings from this investigation will be used to improve Waikato DHB’s information security resilience as we now move beyond the incident.

Whilst Waikato DHB is fully committed to being open and transparent, we are conscious that malicious cyber actors closely monitor public statements on incidents. For this reason, we are not providing details of the investigative findings. Similarly, the costs of the incident will remain confidential. This is to prevent malicious cyber actors from evaluating the commercial impacts of ransomware for District Health Boards in New Zealand, and targeting other organisations.

However, we can confirm that the incident was typical of a ransomware event. Malicious software was used to ‘lock-up’ Waikato DHB’s data (e.g. information and files) and interrupt the function of its digital systems.

Notifications to Impacted Individuals

A key focus of Waikato DHB’s incident response process was to notify all individuals whose personal information was impacted by the event.

During the ransomware event, a set of data was copied outside of Waikato DHB’s IT environment and later disclosed by a third party on the dark web (a hidden part of the internet that can only be accessed using special kinds of software). To identify who and what personal information was affected, Waikato DHB conducted a detailed review of the impacted dataset.

Waikato DHB has now notified all affected individuals in line with our obligations under the Privacy Act. Whilst there is no evidence to suggest that impacted personal information has been misused, Waikato DHB issued notifications and remediation advice to affected individuals so they can take proactive steps to protect themselves moving forward.

We also continue to make available support to anyone who may have questions or concerns about their personal information following the incident (see contact details below).

Waikato DHB has also obtained High Court orders to protect any personal and confidential information that was stolen from further access or publication by media agencies and others.

Ongoing Support

Waikato DHB sincerely apologies to the Waikato community for the added stress this incident has caused during an already challenging time.

Below are the key organisations available to provide support to members of the community who are here to support you, should you have any questions or concerns.

Waikato DHB

By email at: information.sharing@waikatodhb.health.nz
By phone on: 0800 561 234 (Helpline available Monday to Friday).

1. IDCARE

If members of the public have concerns about their information or are seeking additional ways to protect themselves, they may wish to contact IDCARE, New Zealand’s national identity and cyber support community service. IDCARE is a registered New Zealand charity that specialises in working with community members to protect and respond to personal information risks.

IDCARE case managers can be contacted via IDCARE’s ‘Get Help Web Form’ at https://www.idcare.org/contact/get-help, where a confidential discussion with a professional can be arranged at a convenient time.

IDCARE can also be contacted by calling 0800 121 068 between 10am and 7pm (Monday to Friday). There is no cost to the caller for engaging with IDCARE.

IDCARE’s ‘Learning Centre’ is also a good source of valuable information and resources on protecting your personal information: https://www.idcare.org/learning-centre.

2. Privacy Commissioner

The Privacy Commissioner has been notified about this incident. If members of the public have further concerns, they have the right to complain to the Privacy Commissioner.

Please visit the Privacy Commissioner website for further information about privacy rights and responding to cyber security incidents: https://www.privacy.org.nz/your-rights/your-privacy-rights/ .

3. Kaitiaki support

Kaitiaki support can be contacted 24hrs a day, 7 days a week by phoning 021 806 171.

4. Other Key contacts

  • Emergencies: 111
  • Non-urgent health questions: Healthline 0800 611 116
  • Waikato DHB general enquiries, including outpatient clinics: (07) 839 88 99 or 0800 276 216
  • Waikato DHB Privacy enquiries: 0800 561 234
  • Kaitiaki support: 021 806 171

Media enquiries: news@waikatodhb.health.nz

Waikato DHB hospital services have returned to full functionality following the cyber security incident which affected our systems in May 2021.

We thank our people, the community we support, and our partners and regulators for their support, patience, and understanding while working through backlogs and recovering from the incident.

Waikato DHB also wants to take the opportunity to sincerely apologise to the Waikato community for the added stress this incident caused during a challenging time for all.

We also thank everyone for their patience and support while we worked through this cyber incident.

Incident Response
Further to our previous updates, as soon as Waikato DHB became aware of the incident, our incident response plan was implemented to get our digital systems back up and running and securely as possible.

Operational Impacts
In response to the Incident, Waikato DHB implemented containment, eradication and recovery measures that impacted the availability of its systems and the services provided.

Using a staged approach to restore services based on their criticality and once they were secure, with clinical systems prioritised.

We were able to maintain 80% of normal activity levels over the two months following the outage. The type of procedures undertaken by the DHB was also different to normal over this time as some services experienced significant disruption while the impact to others was limited. Where patients required urgent treatment which could not be provided at Waikato DHB facilities, care was outsourced.

To address any backlog of care, at this time we have increased outsourcing, increased theatre time, and evening and weekend procedures. We have also resourced additional clinics. The focus is on those patients with the highest clinical priority, where there are potential equity impacts, and where patients have experienced extended wait times.

Investigation
Below we provide a recap of the ransomware cyber incident that impacted our operations.
What is ransomware?
Ransomware is a type of malicious software used to “lock up” an organisation’s data (e.g. information and files) and interrupt digital systems (e.g. laptops). Where an organisation does not have access to the “key” to unlock the data, it may be required to restore its systems from backups or, where backups are not available, rebuild the systems from scratch.

What does disclosure on the dark web mean?
The impacted dataset was disclosed on the dark web. The dark web is a part of the internet that can only be accessed through special kinds of software. Most dark web websites are not directly accessible via a normal search made through a search engine (such as Google). They effectively hide themselves. They are accessible only if the addresses of those sites are known to the user.

What happened?
On 18 May 2021, we became aware that some of our digital systems were not operating as usual. We immediately took steps to secure our systems. With the support of our IT team and external cyber experts, we initiated an investigation which confirmed that the outage was the result of a ransomware incident.

Waikato DHB then identified that a set of data was copied outside of its IT environment. This dataset has since been disclosed by a third party on the dark web in June 2021. This dataset contained some personal information.

In response, we have been working with cyber security experts, the Police, the Privacy Commissioner, and the National Cyber Security Centre to investigate this incident and ensure that we take appropriate action.

Waikato DHB has also obtained High Court orders to protect any personal and confidential information that was stolen from further access or publication by media agencies and others.

Has there been an investigation?
Waikato DHB initiated an investigation to contain the incident’s impacts and begin the restoration process as quickly as possible. As part of this process, Waikato DHB also notified the Police and the National Cyber Security Centre that the incident appeared to have been caused by a malicious cyber actor.

Expert forensic investigators and third-party incident response and threat eradication specialists have continued to assist Waikato DHB to investigate the incident.

Waikato DHB remains conscious that malicious cyber actors monitor public commentary on incidents. For this reason, we are not providing additional details regarding the incident’s cause, methods used, the value of the ransom or who may be responsible.

Similarly, the costs of the incident will remain confidential. In part, this is to prevent any malicious actors from evaluating the commercial impacts of ransomware for New Zealand District Health Boards and targeting any other organisation.

Data
Following the incident, Waikato DHB later identified that a set of data was copied outside of its IT environment. This dataset has since been disclosed by a third party on the dark web.

Waikato DHB has conducted a detailed review of the impacted dataset with the objective of confirming who and precisely what personal information has been affected. As a result of this review, we were able to notify individuals who had personal information contained in the impacted dataset.

Waikato DHB has also obtained High Court orders to protect any personal and confidential information that was stolen from further access or publication by media agencies and others. Further, we had no evidence to suggest that personal information has been misused but issued notifications so that individuals can take steps to protect themselves moving forward.

This was done by providing several proactive steps to protect against the potential misuse of information. We also reminded the community that support remains open to anyone who may have any questions or concerns about their personal information following the incident. Listed below are some of the organisations (including their contact details) where further support and guidance can be obtained.

As Waikato DHB completes the final notifications, the Privacy Commissioner will continue to be updated with the notification progress and the level of support provided to the community who have any questions or concerns regarding their personal information.

Ongoing Support
Again, Waikato DHB sincerely apologies to the Waikato community for the added stress this incident is causing during a challenging time for all.

Below are some of the organisations that are here to support you should you have any questions or concerns:

1. Waikato DHB
If you have any other questions after reviewing this information in this letter, please do not hesitate to contact us at information.sharing@waikatodhb.health.nz. Alternatively, you can contact us at our helpline on 0800 561 234. The helpline is available 24 hours a day, Monday to Friday.

2. IDCARE
If you have concerns about your information or are seeking additional ways to protect yourself, you may wish to contact IDCARE, New Zealand’s national identity and cyber support community service. IDCARE is a registered New Zealand charity that specialises in working with community members to protect and respond to personal information risks.

You can engage an IDCARE case manager via IDCARE’s ‘Get Help Web Form’ at https://www.idcare.org/contact/get-help, where you can arrange a confidential discussion with a professional at a time that suits you. You can also call 0800 121 068 between 10am and 7pm. There is no cost to you for engaging with IDCARE.

Alternatively, you may visit IDCARE’s ‘Learning Centre’ for further information and resources on protecting your personal information (https://www.idcare.org/learning-centre).

3. Privacy Commissioner
The Privacy Commissioner has been notified about this incident. If you have further concerns, you have the right to complain to the Privacy Commissioner.

You may wish to visit the New Zealand Privacy Commissioner website for further information about your privacy rights and responding to cyber security incidents (https://www.privacy.org.nz/your-rights/your-privacy-rights/).

4. Kaitiaki support
A roster has been set up to ensure 24/7 access to Kaitiaki support. Phone 021 806 171.

5. Other Key contacts

  • Waikato DHB general enquiries, including outpatient clinics: (07) 839 88 99 or 0800 276 216
  • Privacy questions: 0800 561 234
  • Non-urgent health questions: Healthline 0800 611 116
  • Emergencies: 111
  • Kaitiaki support: 021 806 171
  • Media: news@waikatodhb.health.nz

Waikato DHB’s information systems were affected by a cyber security incident on Tuesday, 18 May 2021. This incident affected services at Waikato, Te Kuiti, Taumarunui, Thames and Tokoroa hospitals and our community-based services.

While we continue to receive support from expert cyber security professionals, we wanted to provide an update on progress since our last statement was published on our website.

Waikato DHB also wants to take the opportunity to sincerely apologise to the Waikato community for the added stress this incident caused during a challenging time for all. We also thank everyone for their patience and support while we worked through this cyber incident.

Incident Response
As soon as Waikato DHB became aware of the incident, our incident response plan was implemented to get our digital systems back up and running as quickly and securely as possible. 

This included partnering with Government agencies (e.g. the National Cyber Security Centre) and several New Zealand and international incident response specialists to ensure we retained integrity across Waikato DHB’s digital environment.

However, the incident response process took time as Waikato DHB is a complex organisation serving over 400,000 patients, providing specialist tertiary hospital services and operating several supporting secondary hospitals and facilities.

For example, Waikato DHB maintains a considerable number of servers, thousands of end point devices and uses a significant number of applications for specialist clinical services. All these systems required cleansing or restoration, despite server operating system patches being up to date at the time of the incident.

Waikato DHB has since progressed well through the recovery phase of the incident response process, with most systems returned to full functionality or on standby to be reconnected. This has been a rigorous process to ensure only secure and protected systems were recommissioned in “waves” for use by Waikato DHB following the incident.

Currently, our understanding is that the incident has been successfully contained and no longer presents an ongoing risk from a digital systems perspective. Further, Waikato DHB is also not aware of any stolen data being misused beyond the attempt to extort a ransom from Waikato DHB. However, this is our current understanding, and we are monitoring this closely.

While the primary focus of the incident response process so far has been containment and the restoration of Waikato DHB digital systems, the investigation’s focus has now shifted to reviewing forensic evidence on the sections of Waikato DHB’s digital network that were affected. The findings from this investigation will be used to improve Waikato DHB’s information security resilience as we move forward from the incident.

Information Security Improvements
Waikato DHB continues to strengthen and improve technical and operational security measures to deliver safe healthcare services to the Waikato community.

To achieve this, Waikato DHB has introduced improved security controls across its digital systems, including process controls. Separately, several security reviews have been undertaken, and as a result, Waikato DHB is further strengthening the external perimeter of its digital network.

This is part of a continuing process to uplift operational, technical and governance frameworks related to information security. For example, Waikato DHB continues to switch to cloud-based services  following a Government directive requiring state health providers to adopt such technologies from vendors vetted and approved by the Department of Internal Affairs.

Further, Waikato DHB also continues to recruit IT specialists to strengthen Waikato DHB’s information security posture. These steps align with the direction of the Ministry of Health to progressively modernise the state healthcare sector’s digital environment.

Finally, Waikato DHB continues to maintain compliance with the Health Information Security Framework to drive increased information security and maturity as assessed by security audits.

Together, these measures are an example of how the incident response process will inform Waikato DHB’s information security strategy. Waikato DHB will also work with Government agencies, including other District Health Boards, to share the lessons learned from the incident to support the continuous improvement of New Zealand’s cyber security maturity in the healthcare sector.

Government Agencies
In addition to working with private New Zealand and international cyber security experts, Waikato DHB’s incident response process has involved the Police, the Privacy Commissioner, and the Government Communications Security Bureau (specifically the National Cyber Security Centre) in investigating this incident.

Waikato DHB has also worked with the Inland Revenue Department Te Tari Taake,  Department of Internal Affairs Te Tari Taiwhenua and Waka Kotahi NZ Transport Agency to inform them of the impacts of the incident so that they can monitor for any attempted misuse of stolen data and put any necessary protective measures in place.

The collaboration with such agencies has informed Waikato DHB’s incident response process and ensured that all appropriate steps were taken during the response process.

Criminal Investigation
Immediately following the incident, Waikato DHB took steps to secure our systems. With the support of our internal IT team and external cyber experts, we initiated an investigation to contain the incident’s impacts and begin the restoration process as quickly as possible. As part of this process, Waikato DHB also notified the Police and the National Cyber Security Centre that the incident appeared to have been caused by a malicious cyber actor.

Waikato DHB remains conscious that malicious cyber actors monitor public commentary on incidents. For this reason we are not providing additional details regarding the incident’s cause, methods used, the value of the ransom or who may be responsible.

Similarly, the costs of the incident will remain confidential. In part, this is to prevent any malicious actors from evaluating the commercial impacts of ransomware for New Zealand District Health Boards and targeting any other organisation.

However, what we can say is that the incident was typical of a ransomware event. That being malicious software was used to “lock-up” Waikato DHB’s data (e.g. information and files) and interrupt digital systems. Waikato DHB then received a ransom demand to unlock the data and the digital systems.

During this “lock-up” period, Waikato DHB did not pay the ransom to the malicious cyber actor. Instead, for the most part, Waikato DHB restored its systems from backups recorded the night before the incident.

Privacy
Waikato has been aware of its obligations under privacy laws (including the obligation to notify affected individuals) since it became aware of the incident. For example, Waikato DHB immediately informed the Privacy Commissioner about the incident in accordance with the incident response plan.

Waikato DHB has also continued to provide updates and engage in consultation with the Privacy Commissioner to ensure that appropriate steps were taken to protect the privacy interests of the Waikato community and that helpful support and guidance was made available to those with any questions or concerns.

In terms of notifications to affected individuals, Waikato DHB has now issued over 80% of the total number of privacy notifications. These notifications have been tailored with the guidance and notification methods used, reflecting the level of support required for a particular individual.

As Waikato DHB begins to complete the notification process, the Privacy Commissioner will continue to be updated with the notification progress and the level of support provided to the community who have any questions or concerns regarding their personal information.

More generally, following the data disclosure event, Waikato DHB has also obtained High Court orders to protect any personal and confidential information that was stolen from further access or publication by media agencies and others.

We would also like to remind the community that support remains available to anyone who may have any questions or concerns about their personal information following the incident. Listed below are some of the organisations (including their contact details) where further support and guidance can be obtained.

Ongoing Support
Again, Waikato DHB sincerely apologies to the Waikato community for the added stress this incident is causing during a challenging time for all.

Below are some of the organisations that are here to support you should you have any questions or concerns:

1. Waikato DHB
If you have any other questions after reviewing this information in this letter, please do not hesitate to contact us at information.sharing@waikatodhb.health.nz. Alternatively, you can contact us at our helpline on 0800 561 234. The helpline is available 24 hours a day, Monday to Friday.

2. IDCARE
If you have concerns about your information or are seeking additional ways to protect yourself, you may wish to contact IDCARE, New Zealand’s national identity and cyber support community service. IDCARE is a registered New Zealand charity that specialises in working with community members to protect and respond to personal information risks.

You can engage an IDCARE case manager via IDCARE’s ‘Get Help Web Form’ at https://www.idcare.org/contact/get-help, where you can arrange a confidential discussion with a professional at a time that suits you. You can also call 0800 121 068 between 10am and 7pm. There is no cost to you for engaging with IDCARE.

Alternatively, you may visit IDCARE’s ‘Learning Centre’ for further information and resources on protecting your personal information (https://www.idcare.org/learning-centre).

3. Privacy Commissioner
The Privacy Commissioner has been notified about this incident. If you have further concerns, you have the right to complain to the Privacy Commissioner.

You may wish to visit the New Zealand Privacy Commissioner website for further information about your privacy rights and responding to cyber security incidents (https://www.privacy.org.nz/your-rights/your-privacy-rights/).

4. Kaitiaki support
A roster has been set up to ensure Māori patients and their whanau have 24/7 access to Kaitiaki support. Phone 021 806 171 or ask at the ward reception.

5. Other Key contacts

  • Waikato DHB general enquiries, including outpatient clinics: (07) 839 88 99 or 0800 276 216
  • Privacy questions: 0800 561 234
  • Non-urgent health questions: Healthline 0800 611 116
  • Emergencies: 111
  • Kaitiaki support: 021 806 171
  • Media: news@waikatodhb.health.nz