12. Health Services—Cyber-security ThreatsDr SHANE RETI (National—Whangarei) to the Minister of HealthHealth Services—Cyber-security Threats12. Dr SHANE RETI (National—Whangarei) to the Minister of Health: Does he stand by all his statements and actions on cybersecurity in the health portfolio?Hon Dr DAVID CLARK (Minister of Health): Yes in the context they were given and taken.Dr Shane Reti: When his office told Newshub a few weeks ago that he would not appear on camera to discuss 800000 daily cyber-attacks on the Bay of Plenty District Health Board (DHB) with his office saying I just don't believe your request has reached the threshold I would ask him about." does new select committee information showing 1.7 million cyber-attacks per day on another DHB now reach the threshold for him to front up on camera?Hon Dr DAVID CLARK: No.Dr Shane Reti: Which DHB is reporting being under cyber-attack 1.7 million times per day or 20 times per second?Hon Dr DAVID CLARK: It's impossible to give a definitive answer on the number of cyber-attacks across New Zealand but I'm advised in respect of the reference the member made earlier to the Bay of Plenty example which is a mid-size DHB that it's subject to between three and 10 cyber-attacks per second which is between 260000 and 864000 every day. In that context it is quite impressive that there have been no breaches. I certainly have not been advised of any successful breaches yet. But within a wider context challenges to cybersecurity are real and frequent. The healthcare sector remains one of the most targeted by malicious cyber actors. There are millions of cyber-attacks across New Zealand every day in the health sector. Dr Shane Reti: As the responsible Minister why can he not identify the most cyber-attacked DHB in New Zealand at the moment?Hon Dr DAVID CLARK: What matters are breaches and it is extraordinary in fact in my view that we haven't had any confirmed breaches in New Zealand. We know that in Singapore Hong Kong and also in Mexico in the last month there have been confirmed breaches. These issues are taken incredibly seriously and in fact public discussion of these matters is incredible unhelpful I'm advised by security people and that member knows that.Rt Hon Winston Peters: Is the Minister saying it's when defences aren't working that one should worried—not when they are?Hon Dr DAVID CLARK: That is quite correct and I take my hat off to those people who work day in day out and especially when I'm advised that publicly discussing potential breaches and the response to them can support the activities of malicious cyber actors. That's why it's not in the public interest to discuss any potential breaches in public even to the extent of confirming that a potential breach is being investigated.Dr Shane Reti: In reply to written question No. 16298 he said he would update the Prime Minister on cyber-security issues when necessary; how then has he updated the Prime Minister on a DHB reporting 1.7 million cyber-attacks per day?Hon Dr DAVID CLARK: I think the member has not heard my initial answer.Dr Shane Reti: I raise a point of order Mr Speaker. It's not clear to me that the Minister has addressed the question. I asked him: has he updated the Prime Minister on cyber-security issues?SPEAKER: And I heard the initial answer the member's supplementary question and the Minister's reply. I think he even answered the question—more than just addressed it.Dr Shane Reti: What is the threshold number of cyber-attacks for the Minister to appear on camera?Hon Dr DAVID CLARK: As I think I explained the issue that's important is when there are breaches and if there are any potential breaches I expect to be kept briefed on them. But to repeat—publicly discussing potential breaches and the response to them can support the activities of malicious cyber actors. That's why it's not in the public interest to discuss any potential breaches in public even to the extent of confirming that a potential breach is being investigated. If the member has specific information on potential breaches he should contact my office directly."