Information System Outage and Cyber Security Latest

Waikato DHB's information systems were affected by a cyber security incident on Tuesday 18 May 2021. This incident affected services at Waikato, Te Kuiti, Taumarunui, Thames and Tokoroa hospitals and our community-based services.

Recovery work is ongoing, however the restoration of clinical services was prioritised and all services are currently available for our community.

We thank everyone for their patience while we worked through this cyber security incident. 

Privacy

Since the ransomware event in May 2021, Waikato DHB worked to securely restore its systems, return healthcare services to full operation and investigate what happened.

As a result of these investigations, Waikato DHB identified that a set of data was copied outside of its IT environment. This dataset has since been disclosed by a third party on the dark web. 

Waikato DHB has conducted a detailed review of the impacted dataset with the objective of confirming who and precisely what personal information has been affected.

This process takes time and has involved legal, privacy and clinical experts analysing the data to categorise the types of personal information impacted and identifying the relevant individuals. The DHB has continued to liaise with the Privacy Commissioner throughout this process.

Having conducted the detailed review, Waikato DHB is now in a position to notify another group of impacted individuals with specific details of what personal information has been impacted and provide tailored advice on steps they can take to protect themselves going forward.

This group contains around 4200 individuals, with the method of notification reflecting the type of information and level of support which may be required.

It is important Waikato DHB directly contacts individuals where possible to ensure they receive accurate information and useful support and guidance. These notifications will continue to be delivered as quickly as possible and on a rolling basis (for example, once contact information is available).

However, support remains available to anyone who may have any questions or concerns. Listed below are some of the organisations that continue to provide support and guidance to the community.

We regret that the incident has occurred and apologise for any distress or concern caused.

We also thank the community for their ongoing patience and understanding during this time. In addition to providing support, the protection of our digital systems remains an important focus. Waikato DHB has continued to strengthen and improve the technical and operational security measures used to deliver safe healthcare services to the community.

We have also worked with cyber security experts, the Police, the Privacy Commissioner, the National Cyber Security Centre and the Government Communications Security Bureau to investigate this incident and ensure that we take appropriate action. 

Again, we sincerely apologise to you for the added stress this is causing during a challenging time for all.

Should you have any further questions or concerns, listed below are some of the organisations that are here to support you:

1. Waikato DHB

If you have any other questions after reviewing this information, please do not hesitate to contact us at information.sharing@waikatodhb.health.nz. Alternatively, you can contact us at our helpline on 0800 561 234. The helpline is available 24 hours a day, Monday to Friday.

2. IDCARE

If you have concerns about your information or are seeking additional ways to protect yourself, you may wish to contact IDCARE, New Zealand’s national identity and cyber support community service. IDCARE is a registered New Zealand charity that specialises in working with community members to protect and respond to personal information risks.

You can engage an IDCARE case manager via IDCARE’s ‘Get Help Web Form’ at https://www.idcare.org/contact/get-help, where you can arrange a confidential discussion with a professional at a time that suits you. You can also call 0800 121 068 between 10am and 7pm. There is no cost to you for engaging with IDCARE.

Alternatively, you may visit IDCARE’s ‘Learning Centre’ for further information and resources on protecting your personal information (https://www.idcare.org/learning-centre).

3. Privacy Commissioner

The Privacy Commissioner has been notified about this incident. If you have further concerns, you have the right to complain to the Privacy Commissioner.

You may wish to visit the New Zealand Privacy Commissioner website for further information about your privacy rights and responding to cyber security incidents (https://www.privacy.org.nz/your-rights/your-privacy-rights/).