What happened
In August 2019 the website of Tū Ora Compass Health, a Wellington-region primary health organisation, was defaced in a global cyber incident and its server taken offline. The investigation that followed found four intrusions dating back to 2016 [tuora-hinz]. In October 2019 Tū Ora disclosed that the information of up to around 1 million people may have been exposed [tuora-1news], [cshub-tuora]; the Ministry of Health and Tū Ora also put the figure at more than 900,000 [tuora-hinz]. Tū Ora could not confirm whether data had actually been accessed because it had no audit logs [tuora-hinz]. A national review of health-system security followed [tuora-hinz].
Timeline
- 2019-08-05 — Website defaced in a global cyber incident; server taken offline. The investigation later found four intrusions dating back to 2016 [tuora-hinz].
- 2019-09 — Tū Ora voluntarily notified the Office of the Privacy Commissioner [cshub-tuora].
- 2019-10-04 — Public disclosure; up to ~1M people potentially affected [tuora-1news].
Current status
Disclosed. A Police investigation was reported in October 2019 [tuora-hinz]; we have not found a published Privacy Commissioner or Police outcome. The “up to 1 million” figure reflects potential exposure as reported; it was not established that any records were accessed [tuora-hinz].
Why it matters
Multiple undetected intrusions over several years, and no audit logs to show what was taken, left Tū Ora unable to tell patients whether their data had been accessed.