What happened
On 18 May 2021 a ransomware attack crippled the Waikato District Health Board, taking hospital IT systems offline for weeks and forcing procedures to be postponed [twowaikato]. Stolen patient and staff information was subsequently released to media and online [rnz-waikato]. The NZ Privacy Commissioner issued a statement urging people to do the right thing with the stolen personal information [opc-waikato]. The exact number of people affected was not officially quantified and is not estimated here.
Timeline
- 2021-05-18 — Ransomware attack; systems down across Waikato hospitals [twowaikato].
- 2021-05 — The Privacy Commissioner issued a statement on handling the stolen information [opc-waikato].
- 2021-06-29 — Stolen documents reported released online [rnz-waikato].
- 2021-06-30 — The Privacy Commissioner said his office was not investigating at that time [rnz-opc].
- 2022-12-06 — Te Whatu Ora released the redacted incident response analysis report [twowaikato].
Current status
Disclosed. The Privacy Commissioner said the DHB would not be fined but could face liability if harm resulted, and that his office was not investigating at that time [rnz-opc].
Why it matters
The most disruptive attack on a New Zealand hospital system to date — a case study in the operational and safety impact of health-sector ransomware, not just data loss.