What happened
In late September 2022 Pinnacle Midlands Health Network — a large North Island GP network operating across Waikato, Taranaki and Tairāwhiti — was hit by a cyber attack. It announced the incident on 4 October 2022, saying at that point it could not confirm what specific data had been accessed [rnz-pinnacle-initial]. Patient data was later posted to the dark web [rnz-pinnacle], [nzh-pinnacle]. Media reported the exposed information as including patient addresses, National Health Index (NHI) numbers, immunisation and screening status, and data about services provided [rnz-pinnacle]. The NZ Herald reported the ransomware group as ALPHV/BlackCat [nzh-pinnacle].
Timeline
- 2022-09-28 — Cyber attack on Pinnacle’s systems [rnz-pinnacle-initial].
- 2022-10-04 — Pinnacle publicly announced the incident and notified the Office of the Privacy Commissioner and Police [rnz-pinnacle-initial].
- 2022-10-10 — Data confirmed as posted to the dark web [rnz-pinnacle].
Current status
Disclosed. Pinnacle said it was working with Police and the Office of the Privacy Commissioner [rnz-pinnacle-initial]. Initial reports suggested up to 450,000 people may have been affected; Pinnacle has not confirmed a figure, so no count is asserted here [rnz-pinnacle], [nzh-pinnacle]. We have not found a published Privacy Commissioner outcome.
Why it matters
A primary-care network holds identifying and clinical data on a very large population. The publication of that data to the dark web — including NHI numbers — makes this one of the more serious health-sector breaches on the New Zealand record.