hack was published around 10pm<\/a> on December 29, the MMH website notice appeared on the afternoon of December 31, but the site wasn\u2019t taken offline until that evening.\u201d<\/p>\nFurthermore, the company was taking too long to inform affected clinics and patients, he said.<\/p>\n
\u201cIt should have been able to determine the extent of the breach relatively quickly. The fact that, days later there is no clear confirmation about what was accessed or copied is worrying.\u201d<\/p>\n
However, there was no guarantee that giving in to the hackers\u2019 demands would solve the problem for MMH, he said.<\/p>\n
\u201cThey may still release the data anyway, they may still contact people, we have no way of knowing if they will honour it.<\/p>\n
\u201cFurthermore, if that person is from a country with sanctions, there are laws and treaties that forbid that payment from being made legally as well.\u201d<\/p>\n
Patients were just collateral damage, he said.<\/p>\n
\u201cI will personally probably look to close my account. I can\u2019t really have confidence in the system after this. Hopefully my clinic will find a solution that\u2019s better.\u201d<\/p>\n
Hackers building their \u2018brand\u2019<\/p>\n
Data journalist Keith Ng said the hackers appeared to be using ManageMyHealth to leverage a bigger payout from one of their other targets: Saudi Icon Ransom.<\/p>\n
\u201cThey\u2019re implying they\u2019ve got their hands full and don\u2019t want to be distracted by small fry here, that\u2019s their explanation for wanting this over quickly \u2013 and if they don\u2019t get their ransom they will release data for free.\u201d<\/p>\n
For Kazu, it was an exercise in brand management.<\/p>\n
\u201cThey want to establish themselves as a \u2018trustworthy\u2019 ransomware group. By that they mean \u2018If you pay us, we\u2019ll delete the data and you\u2019ll never hear from us again. If you don\u2019t pay us, bad things will happen to you\u2019.<\/p>\n
\u201cSo they want to build up their business and use the New Zealand dataset to make an example out of, so people will take them more seriously in the future.\u201d<\/p>\n
Unfortunately, the ManageMyHealth breach was unlikely to be the result of a sophisticated hacking operation, Ng said.<\/p>\n
\u201cThis is probably a couple of days\u2019 work for a couple of people. It\u2019s not like an elite hacking crew, it\u2019s about volume and they want to make sure they\u2019ve got targets on the hook all the time.<\/p>\n
\u201cThey poke around and try to find common vulnerabilities, flaws, they\u2019re really looking for low hanging fruit – and if they don\u2019t find it, they move on quickly to the next target.\u201d<\/p>\n
Over and above the technical question of which part of ManageMyHealth\u2019s system was not secure, the more important question was what processes it had in place, whether it was having regular independent security audits and taking action to fix the problems identified, he said.<\/p>\n
\u201cA business that sets itself up as a health information management system has a lot of incentive to do things right because when they fail, really catastrophic things like this happen, and it is an existential risk for them.<\/p>\n
\u201cSo we should expect better from these businesses and the fact they let this one slip past them, they should be held accountable.\u201d<\/p>\n
In its public statements, ManageMyHealth appeared to be trying to minimise the scale of the problem, Ng said.<\/p>\n
\u201cThey\u2019re saying only 7% of users were affected, but 7% of 1.8 million is quite a big number. The other thing they\u2019ve said is \u2018only one component\u2019 of the site is affected, not the core database. But it\u2019s the kind of things in there \u2013 medical photos, test results \u2013 which make it so sensitive and damaging for people who are affected.<\/p>\n
\u201cIt\u2019s probably the worst data breach that I recall seeing in New Zealand so far.\u201d<\/p>\n
Aura Information Security\u2019s Patrick Sharp said medical records were hugely valuable to criminals.<\/p>\n
The Medibank ransomware attack in Australia in 2022 resulted in many thousands \u2013 \u201cmaybe even hundreds of thousands\u201d of real financial crimes, he said.<\/p>\n
\u201cIt\u2019s quite likely that the 126,000 or so people affected \u2013 depending on the kind of information involved \u2013 may suffer at the hands of criminal gangs, lots of scams, blackmail, those kind of things.\u201d<\/p>\n
ManageMyHealth has been approached for comment.<\/p>\n","protected":false},"excerpt":{"rendered":"Kazu said it had opted for a low-ball ransom demand of $60,000 \u201cto protect the data and quickly…\n","protected":false},"author":2,"featured_media":216824,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[1975,4378,5658,130883,31037,18558,127691,111,43,139,69,1118,6293,7192,6624,14168],"class_list":["post-216823","post","type-post","status-publish","format-standard","has-post-thumbnail","category-new-zealand","tag-at","tag-breach","tag-experts","tag-extortion","tag-hill","tag-identity","tag-managemyhealth","tag-new-zealand","tag-news","tag-newzealand","tag-nz","tag-of","tag-patients","tag-risk","tag-ruth","tag-theft"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/216823","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=216823"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/216823\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/216824"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=216823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=216823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=216823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}