New Zealand Probes Ransomware Hack of Health Portal

The New Zealand government is probing a year-end ransomware hack of private healthcare service provider Manage My Health that impacted thousands of patients. Digital extortion group Kazu has claimed responsibility and threatened to leak the data on Jan. 15 unless it receives a $60,000 ransom.

See Also: How Staffing Reductions Increase Ransomware Risk

Manage My Health is an online portal used by more than 1.85 million New Zealanders for booking medical appointments and accessing health records and prescriptions. Kazu has claimed that it stole 4.15 terabytes of data, which is over 700 files. The company on Thursday acknowledged that hackers broke into its network in a breach it detected on Dec. 30. The company estimates that breach affected 7% of its customers, or an estimated 126,000 people. Hackers did not breach its “core patient database,” the firm said.

Describing the incident as “incredibly concerning,” Health Minister Simeon Brown on Sunday said the government will review the incident and the extent to which third parties have access to patient data.

“What happened here is unacceptable and we need to make sure that we get to the bottom of this and we need to make sure that we learn the lessons. At the moment, obviously, the focus is on responding,” Brown during a Sunday press conference.

A preliminary assessment by the government has determined the incident did not impact Health New Zealand systems, 1 News reported.

Analysis by Adam Burns, CEO of New Zealand-based cybersecurity firm BlackVeil, found that Manage My Health used weak domain encryption and endpoint security. Its domain-based message authentication, reporting, and conformance only had a monitoring feature enabled – meaning that it logged spoofing attempts, but did not enact counter measures.

“The breach wasn’t sophisticated. Kazu isn’t some nation-state actor. They’re asking for $60,000 -pocket change in the ransomware world.” Burns said. “This was preventable with basic security hygiene. The gaps we found today should have been fixed years ago.”

Burns said the incident highlights ongoing security gaps within New Zealand’s healthcare sector, which runs on legacy systems “held together with duct tape.” In 2021, a ransomware attack against the Waikato District Health Board was largely attributed to its use of legacy systems.

“Attackers actively scan for these outdated systems because they provide a straightforward, low-effort entry point,” said Dray Agha, senior manager of security operations at cybersecurity Huntress. “They can use widely available tools to intercept or exfiltrate data by breaking the weak encryption, often without the organization detecting the breach until it’s too late.”

Manage My Health has faced criticism about how it handled news of the breach. Luke Bradford, president of the Royal New Zealand College of General Practitioners, told local news outlet RNZ that he found out about the incident through Facebook. Manage My Health in a FAQ page says to those asking “why wasn’t I told sooner?” that it’s “immediate priority was to secure the Manage My Health platform and protect patient data.” For those who heard about the incident first through social media, “We understand the frustration this causes,” the FAQ reads.