Waikato DHB cyber attack: Medical files may have been taken

Waikato District Health Board and the Minister of Health cannot rule out the possibility medical files have fallen into the wrong hands after last week's cyber attack, but say they are working hard to get to the bottom of the problem.

The entire system crashed nearly a week ago and it is not likely to be back online until possibly the end of this week.

The DHB said progress was being made and any resumption of services would be done carefully and in a phased manner.

The ransomware attack may have accessed private medical information, but the DHB said there was no evidence, at this point, that any data had been stolen.

Minister of Health Andrew Little told Checkpoint he could not give the public an assurance their data was safe.

"The advice I have been given is there a chance data has been exfiltrated from that system.

"This does happen, and it will be for Kevin [Snee, Waikato DHB chief executive,] and his team... to determine eventually what the level of exposure is.

"All the advice I have had so far is they have got into the system and encrypted it and there is a risk they will have taken data ... and put it somewhere else for later use.

"I expect that once they have got all the systems up and running, then there will have to be a review of the state the system was in."

Little was "surprised" that the attack took the whole system down.

"That's a high degree of exposure. You would expect in this day and age... there would be adequate protection."

He did not "want to be seen to be implying anything" regarding the state of the DHB's IT security.

He had no information about who the attackers were.

"These things can take weeks or months to determine the nature of the attacker."

If it were a "state actor", he said, it would become an issue for foreign affairs.

Regardless of that however, it was a hostile act, he said.

Waikato DHB chief executive Kevin Snee acknowledged there may be some anxiety about the fate of data and information held by the DHB.

''As a precaution, we have reported to the Privacy Commissioner and we are working closely with the National Cyber Security Centre and with the police and we will continue to work with our cyber security experts.''

He said anyone worried about their medical records being stolen should seek ways to protect themselves.

"Patients need to be careful of scamming emails, the usual scamming emails that come through. We will be putting information up on our website about what to look out for and we will be running an 0800-number from tomorrow."

Snee said he could not rule out some data being lost forever.

"We back up on a daily basis so really the vast majority of the files should be recoverable. It is possible that there is a small number of files that we can't recover but in the overall scheme of things should be small."

He said the recovery phase would take some time as it would mean inputting handwritten data into the restored system.

Services such as radiotherapy, which is delivered by a linear accelerator and solely reliant on software to work, were causing the biggest headache for the DHB.

Snee said much of the systems in a modern hospital were dependent upon software, which was good when it worked.

"Some things, because we are having to communicate differently, are working a little better. So maybe there are some things we actually need to look at and retain, and maybe there are things we can do to build some of those things back and when we come out of this there are some things that we do better."

Hospital and community services director Chris Lowry said staff were working under trying circumstances, like a clinical nurse specialist involved in elective surgeries.

"Instead of documents being able to be emailed from one department to another, they had walked something like 10 kilometres in a day just hand delivering the referrals and other medical documentation. So I guess that is a really good example of - especially with the size of Waikato Hospital - of what impact it has on staff and the way they are working and the time it is now taking to do some of the chores that normally wouldn't have taken long to do at all."

The DHB said about 80 percent of elective surgeries and outpatient clinics went ahead last week and similar numbers were expected this week.