OK, what did I miss?<\/p>\n
A major ransomware incident! The target was Manage My Health, a private company that runs an online portal used by private healthcare providers for sharing information with patients. It counts 1.8 million users.\u00a0<\/p>\n
While primary care providers like GPs can access some government funding for enrolled patients, they are private businesses. This means they can set their own fees and choose which software they use. Many, but not all, enlist Manage My Health: it\u2019s the most-used patient portal in New Zealand.<\/p>\n
An estimated 430,000 patient files were stolen in the breach, which Manage My Health became aware of on December 30. Hackers had accessed a single \u201chealth documents\u201d module<\/a> containing user-uploaded files, specialist referral letters and \u201csome<\/a>\u201d hospital discharge summaries, all of which were downloaded in the theft.\u00a0<\/p>\n Woah, why would someone do that?<\/p>\n For money, duh. The hackers demanded a ransom of US$60,000 (around NZ$104,000) and threatened to release the files if it wasn\u2019t paid. A deadline was set for Tuesday, January 6, then extended to Friday, January 9.\u00a0<\/p>\n It\u2019s understood that a hacker called \u201cKazu<\/a>\u201d is behind the attack. Someone claiming to be them spoke to the Herald<\/a> via Telegram, explaining that they target healthcare companies and set ransoms at affordable levels \u2013 which they alleged most targeted companies end up paying \u2013 before outlining at length the rationale and methodology behind their hacks. Past targets reportedly<\/a> include companies and governments around the world.<\/p>\n As of January 13 it wasn\u2019t clear whether the ransom deadline had been extended again, nor whether Manage My Health was willing to pay it. \u201cThis incident is subject to a police investigation. MMH is unable to provide any comment relating to the hacker, or any ransom demand. Police advice is that third parties should not engage directly with criminal hacker groups, including in this situation,\u201d the company said in a statement on Friday. \u201cThe New Zealand government recommends not paying a ransom. Payment does not guarantee that you will get your data back.\u201d<\/p>\n Through the \u201cfront door\u201d, apparently. The hackers used a \u201cvalid user password<\/a>\u201d to gain access, possibly obtained via automated login attempts.<\/p>\n Shit. Who\u2019s affected?<\/p>\n All up, 125,000 users and 355 \u201creferral-originating GP practices\u201d have been caught up in the breach. Manage My Health is responsible for notifying them all.<\/p>\n On January 8 it began alerting people caught up in the hack. Not everyone was contacted immediately, with the company instead taking a phased<\/a> approach, which caused some frustration and concern among users. There were reports<\/a> of people contacting their GPs directly in the wake of the breach to find out whether they were affected, while others claimed the Manage My Health website crashed<\/a> when visited.<\/p>\n Northland has been disproportionately affected in the breach, with data from 45 primary care practices and 80,000 patients accessed. The region is the only one in the country where Health NZ, the government\u2019s public healthcare provider, uses Manage My Health to share information with patients, according to RNZ<\/a>.<\/p>\n How\u2019s Manage My Health been handling it?<\/p>\n Chief executive Vino Ramayah admitted the company \u201cdropped the ball\u201d and has apologised \u201cfor the pain and disruption that this incident has caused to our providers and patients as a result of this criminal activity against our systems\u201d.<\/p>\n It first flagged the breach with GPs on December 3. The Office of the Privacy Commissioner \u2013 an independent Crown entity that works to ensure compliance with the Privacy Act and assist victims \u2013 was alerted<\/a> on January 1 at 3.30am.\u00a0 Manage My Health also notified the police, Health NZ and \u201cother organisations\u201d, engaged independent cyber security specialists, is monitoring data leak websites and has prepared takedown notices.<\/p>\n Half of affected users had been notified via email by last Friday and an 0800 helpline was set up by Manage My Health to provide support.<\/p>\n It also filed an urgent injunction against \u201cunknown defendants\u201d with the High Court, aimed at preventing third parties accessing any leaked data. Justice Andru Isac ruled<\/a>\u00a0that there was \u201cno doubt that sensitive patient information has been unlawfully obtained\u201d with the purpose of extorting payment. \u201cThose responsible have sought to make plain the seriousness of their threat by publishing a small sample of the stolen data.\u201d<\/p>\n What should I do?<\/p>\n If your GP uses the Manage My Health portal and if you haven\u2019t done so already, log in to Manage My Health to see if you\u2019re affected. Even if you\u2019re in the clear, changing your password and turning on two-factor authentication is recommended. You can also contact your healthcare provider if you\u2019re really concerned (but be mindful of the extra workload the whole situation has created for GPs). The Privacy Commissioner advises<\/a> people experiencing \u201cactual or potential\u201d privacy harm to make a complaint with Manage My Health and CC in your GP. If you believe your information is being used for fraud, criminal activity or for identity theft then you need to contact the police.<\/p>\n What\u2019s the response been?<\/p>\n Not stoked. GPs are stressed, patients are frustrated and freaked out<\/a>. Some were surprised to learn <\/a>that Manage My Health and other patient portals weren\u2019t government run.<\/p>\n Industry representatives and ministers are disappointed with how the situation has been handled. The College of GPs called Manage My Health\u2019s response to the breach \u201cshambolic, frustrating and slow<\/a>\u201d. Health minister Simeon Brown told The Post the company had been \u201cacting too slowly<\/a>\u201d and questioned its communication with users. (Manage My Health admitted that it \u201ccould have done a better job at communication\u201d.)<\/p>\n There has been criticism of Manage My Health\u2019s security practices. It\u2019s up to the user to enable optional two-factor authentication, which is considered the \u201cgold standard<\/a>\u201d for online safety. \u201cMulti-factor authentication really needs to be mandatory across all accounts for it to be properly effective,\u201d digital specialist Callum McMenamin told RNZ<\/a>. (He also pointed out that it was mandatory on the KFC app.)<\/p>\n Many experts have stressed how serious the situation is. The scale of the incident is \u201cdire\u201d and, according to digital investigator Keith Ng<\/a>, the worst data breach Aotearoa has seen in a decade.\u00a0<\/p>\n The Ministry of Health has been tasked<\/a> with a review of the response to the breach, which Brown described as a \u201cwake-up call<\/a>\u201d. That\u2019s due to start before the end of the month. Manage My Health said it welcomed the review and planned to \u201ccooperate fully\u201d, while chief executive Ramayah told RNZ he was \u201cnot unprepared to step down\u201d.<\/p>\n As far as the ransom goes, Manage My Health has made it clear it won\u2019t comment further on the matter, due to the ongoing police investigation. But if it\u2019s not paid, the hackers could potentially sell the files to buyers \u2013 likely on the dark web \u2013 to extract the value they didn\u2019t get from the company.\u00a0<\/p>\n Other than the ransom money, what else is at stake?<\/p>\n A lot, actually. Personal details obtained from a breach like names, birth dates and phone numbers could be used for cyber thefts like accessing bank accounts. Health records can contain highly sensitive information. \u201cScammers can use knowledge of the patients to pose as their doctors. Mentally or physically vulnerable individuals can be targeted for crimes,\u201d wrote<\/a> Keith Ng in the Herald. He also noted that the High Court injunction would do little to mitigate harm.<\/p>\n Records of sexual assault, family violence and stigmatised conditions could be used for blackmail, intimidation or accessed by abusive partners. Victim advocates have said<\/a> knowledge of the hack could cause trauma for users even if their files weren\u2019t accessed.<\/p>\n The fact that a data breach of this magnitude happened could result in the \u201cnewly tech-wary<\/a>\u201d public having reduced trust in online services and the healthcare system. With digital systems and services playing a growing role within the healthcare industry, cyber security and data privacy is increasingly important. Some experts suggest<\/a>\u00a0there should be government-enforced data security standards.<\/p>\n","protected":false},"excerpt":{"rendered":"Missed the news about the massive data breach that\u2019s affected hundreds of thousands of New Zealanders? Here\u2019s a…\n","protected":false},"author":2,"featured_media":231972,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[492,24153,21913,14093,134,111,43,139,69,2935,145],"class_list":["post-231971","post","type-post","status-publish","format-standard","has-post-thumbnail","category-new-zealand","tag-comments-enabled","tag-cyber-attacks","tag-data-privacy","tag-gps","tag-health","tag-new-zealand","tag-news","tag-newzealand","tag-nz","tag-society","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/231971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=231971"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/231971\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/231972"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=231971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=231971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=231971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Hackers are reportedly holding private patient files to ransom (Headlines: The Post, RNZ, the Herald)
\nSo how did it happen?<\/p>\nThe breach has highlighted the importance of data security and raised questions around accountability and action. (Headlines: Stuff, RNZ, the Herald, government press release)
\nWhat next?<\/p>\n