Manage My Health said late on Monday, ahead of the deadline, that any ransom demand was a matter for Police.<\/p>\n
It said it would not be making any comment about a ransom while an investigation was ongoing.<\/p>\n
The platform said it was sincerely sorry for pain and anxiety caused to health providers and patients.<\/p>\n
\u201cWe acknowledge we could have done a better job at communication,\u201d it said in a statement.<\/p>\n
\u201cHowever, our priority was to secure patient data and work on the accuracy of all information before providing it to practices and patients.\u201d<\/p>\n
It said it would be publishing daily updates with all the information it was able to share.<\/p>\n
Brown, speaking after announcing an urgent review into the breach, said he had raised communication with the platform.<\/p>\n
\u201cI spoke to the CEO last week, made my expectations incredibly clear around the need for Manage My Health to be clear and transparent with its communications to the public and its users and to work closely with agencies and to make sure that they are following their advice,\u201d he told RNZ.<\/p>\n
Brown described the data disappearing as \u201cpretty unacceptable\u201d.<\/p>\n
Health Minister Simeon Brown. Photo \/ RNZ, Mark Papalii<\/p>\n
Luke Hogan, a senior technical manager who works at Intellium, said he could not see Manage My Health recovering.<\/p>\n
\u201cI don\u2019t know how they\u2019re going to come back from this, it\u2019s a bit tough,\u201d he said.<\/p>\n
\u201cFor me, it\u2019s really, really disappointing that basic cyber security has not been taken seriously.<\/p>\n
\u201cFrom my perspective, health data is right up there with financial data, some of the most critical data that needs to be protected.<\/p>\n
\u201cIt\u2019s just very, very disappointing and a little bit shocking as an IT professional to hear that this has happened\u201d.<\/p>\n
Will ransom be paid?<\/p>\n
While Manage My Health would not be drawn on the ransom, a former intelligence officer said in general they should not be paid.<\/p>\n
Antony Grasso had also worked at the Government Communications Headquarters (GCHQ), the United Kingdom\u2019s intelligence, security and cyber agency.<\/p>\n
He himself was a Manage My Health user.<\/p>\n
\u201cI personally would advise not to, even if it was my own data that was going to get released, which it may be,\u201d he said.<\/p>\n
\u201cIt\u2019s a tough call without giving the full context but the general rule is not to pay the ransom, that\u2019s the general rule.<\/p>\n
\u201cI mean, you\u2019re bargaining with effectively criminals or thieves, and there\u2019s no honour amongst thieves, we know that, and they may release it anyway and it also means we\u2019re a soft touch.\u201d<\/p>\n
Grasso said he had not seen Manage My Health take many tangible actions after the breach.<\/p>\n
\u201cYou know, just as a general bod on the street, I don\u2019t feel like they will necessarily have had a good plan for the response.<\/p>\n
\u201cI haven\u2019t seen a lot of transparency and I haven\u2019t seen a lot of action that I would expect for a company that\u2019s holding that much private information.\u201d<\/p>\n
Grasso hoped security companies used by the platform would be dumped and have nothing to do with it in the future.<\/p>\n
\u201cBecause clearly, somebody\u2019s dropped the ball.\u201d<\/p>\n
\u2018Rumours for some time\u2019 – Deputy Privacy Commissioner<\/p>\n
Deputy Privacy Commissioner Liz MacPherson told RNZ she believed issues had surfaced in the past.<\/p>\n
\u201cAs I understand it there have been rumours for some time but the issue we\u2019ve got is that there are white-knight hackers and others out there who do raise these issues, quite often it\u2019s very difficult to know whether these people are actually hackers themselves or whether they are white knights, so it\u2019s difficult to police,\u201d she said.<\/p>\n
A white knight is a hacker who acts with good intentions to get vulnerabilities fixed.<\/p>\n
\u201cSo as I understand it, these issues have been drawn to Manage My Health in the past and I think to some media outlets as well,\u201d MacPherson said.<\/p>\n
Liz MacPherson. Photo \/ RNZ, Dom Thomas<\/p>\n
She said the office was irked by widespread complacency around cyber security.<\/p>\n
\u201cThe frustration for us at the Office of the Privacy Commissioner is that we continue to see complacency from, and this is across the board … a continuation of the \u2018it\u2019ll happen to somebody else, not to me\u2019 type approach.<\/p>\n
\u201cAnd you have to ask the question, is the lack of a penalty regime part of that?\u201d<\/p>\n
MacPherson said fines in Australia used to be around $3.3 million but had risen significantly.<\/p>\n
\u201cSo the major breaches risk fines of up to greater than A$50m, which is three times the financial gain from the breach, or 30% of the company\u2019s turnover.<\/p>\n
\u201cI guess what I\u2019m saying to you is that we didn\u2019t even have the lower level fines that they had, which were around $2-3 million,\u201d she said.<\/p>\n
\u201cWe don\u2019t have any penalties, we do not have a civil penalty rating.\u201d<\/p>\n
What Manage My Health says<\/p>\n
Manage My Health, in its latest update, said it wanted to reassure the public that its team had been working tirelessly through the holiday period.<\/p>\n
\u201cSecondly, we have been working as part of a cross-sector group to implement processes to begin communication with affected practices and patients,\u201d it said.<\/p>\n
\u201cWe acknowledge that this delay has been a cause for concern.\u201d<\/p>\n
The platform said it welcomed the review launched by the Health Minister and it would fully cooperate.<\/p>\n
It said its international team was monitoring known data leak websites and was prepared to issue takedown notices immediately if any stolen information was posted.<\/p>\n
It had also obtained a High Court injunction preventing third parties from accessing data posted as a result of the cyber attack.<\/p>\n
The High Court in Wellington has confirmed to RNZ it received an application for an injunction.<\/p>\n
– RNZ<\/p>\n","protected":false},"excerpt":{"rendered":"Manage My Health said late on Monday, ahead of the deadline, that any ransom demand was a matter…\n","protected":false},"author":2,"featured_media":218335,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[28823,52056,4378,3105,45688,42,134,31037,9554,4977,43,131794,6624,40,38,41,39,6038],"class_list":["post-218334","post","type-post","status-publish","format-standard","has-post-thumbnail","category-headlines","tag-arrives","tag-baker","tag-breach","tag-data","tag-deadline","tag-headlines","tag-health","tag-hill","tag-manage","tag-my","tag-news","tag-ransom","tag-ruth","tag-top-news","tag-top-stories","tag-topnews","tag-topstories","tag-wilson"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/218334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=218334"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/218334\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/218335"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=218334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=218334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=218334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}