Waikato Hospitals ransomware attack (2021)

Date 	18 May 2021.Helen Livingstone, New Zealand hospital faces second week of disruption after major cyber attack, The Guardian (24 May 2021)
Suspected actor	An unidentified group claimed responsibility for the cyber-attackElizabeth Binning and Nikki Preston, Waikato DHB cyber attack: Group claims responsibility, says it has confidential patient details, NZ Herald (25 May 2021) in an alleged communication with Waikato district health board (DHB), and later on through an email sent to several media organizations, in which it claimed to have accessed patients and staff’s confidential information.
Target 	Five hospitals (Waikato, Thames, Te Kuiti, Tokoroa and Taumarunui) of the Waikato DHB in New Zealand.Waikato DHB, Waikato DHB Information System latest update (24 May 2021)
Target systems 	The hospitals’ Microsoft Windows-based computer information systems, phone lines and payroll systems.Helen Livingstone, New Zealand hospital faces second week of disruption after major cyber attack, The Guardian (24 May 2021); Waikato DHB, Waikato DHB Information System down (18 May 2021)
Method 	According to Waikato DHB’s chief executive, Kevin Snee, the malicious software allegedly entered the network by a phishing operation through an email attachment,Waikato DHB, Waikato DHB Information System latest update (19 May 2021); Nikki Preston, Cyber attack on Waikato DHB's IT system won't be fixed until the weekend, NZ Herald (18 May 2021); Ben Leahy, New Zealand's hospitals battle daily cyber attacks: Ministry of Health, NZ Herald (19 May 2021); NZ Hit, The Waikato District Health Board cyber attack has been a wake-up call for all businesses, organisations, and people in Aotearoa (2021) blocking access to the systemsRizwan Asghar, A cyberattack lesson from Waikato DHB, News Room (21 June 2021) and encrypting the data.Jamie Tarabay, New Zealand Hospitals Under Prolonged IT Outage From Ransom Hack, Bloomberg (25 May 2021) 
The board was allegedly already warned through an internal cyber-security report drafted before the attackNatalie Akoorie, Waikato DHB warned a cyberattack 'catastrophic for patient safety', RNZ (12 November 2021) that DHB’s IT security was susceptible to a major cyber-attack since some of their computers were running outdated and unsupported operating systems (Windows 7)Natalie Akoorie, Waikato DHB cyber attack: Old software susceptible to malware was being used by some staff, Stuff (5 November 2021) and security measures and thus were exposed to virus and malware threats.
Purpose 	The attackers aimed at gaining financial profit. The unidentified group stole and “hijacked” confidential information from patients, employees and financial data. The hackers allegedly communicated with Waikato DHB with a ransom demand to unlock the data and the digital systemsWaikato DHB, Information System Outage and Cyber Security Latest (28 October 2021) and provided seven days to contact them in order to restore access to the systems. The chief executive stated that “there would be no ransom payment and that the Board had backups for all its files that it would use to rebuild its system”.
Result 	The IT services from the five Waikato DHB Hospitals were brought down,Natalie Akoorie, Waikato DHB warned a cyberattack 'catastrophic for patient safety', RNZ (12 November 2021); Nikki Preston, Cyber attack on Waikato DHB's IT system won't be fixed until the weekend, NZ Herald (18 May 2021) representing more than 600 servers. As a result, patients’ information became inaccessible,NZ Hit, The Waikato District Health Board cyber attack has been a wake-up call for all businesses, organisations, and people in Aotearoa (2021) forcing the personnel to manually take notes,Nikki Preston, Cyber attack on Waikato DHB's IT system won't be fixed until the weekend, NZ Herald (18 May 2021) track appointments,Waikato DHB, Waikato DHB Information System latest update (21 May 2021) patients and critical clinical information.Andrew McRae, Cyber attack: More to miss out on surgery as Waikato DHB rebuilds IT system, RNZ (24 May 2021); Helen Livingstone, New Zealand hospital faces second week of disruption after major cyber attack, The Guardian (24 May 2021) Communications through the hospitals’ phone lines were hindered,Ben Leahy, New Zealand's hospitals battle daily cyber attacks: Ministry of Health, NZ Herald (19 May 2021) many elective surgeries for inpatients were deferred − based on their dependence on laboratory and radiological services −,Andrew McRae, Cyber attack: More to miss out on surgery as Waikato DHB rebuilds IT system, RNZ (24 May 2021) and some outpatient clinics were reducedWaikato DHB, Waikato DHB Information System latest update (19 May 2021) or cancelled.Waikato DHB, Waikato DHB Information System down (18 May 2021) The emergency departments remained in use exclusively for critical cases.Waikato DHB, Waikato DHB Information System latest update (25 May 2021) Moreover, oncological patients had to be transferred to other providers across the country to assure continuity of their radiation therapy treatmentsWaikato DHB, Waikato DHB Information System latest update (26 May 2021); New Zealand Parliament, Urgent Debate — Ransomware Attack — Waikato District Health Board (29 June 2021) with the least disruption possible.Waikato DHB, Plans in place for Waikato DHB cancer patients (26 May 2021) In addition, payment of staff wages was interrupted due to interference with the payroll forcing DHB to develop a contingency plan.Waikato DHB, Waikato DHB Information System latest update (24 May 2021)
Although at first there was no clear evidence if data had been accessed, the unidentified group contacted several local media outlets on 25 May 2021, claiming that it exfiltrated confidential information, including personal information from patients and employees and financial data, and stating that one more chance was given to DHB to contact them. The media refused to publish the received information and refer it to the police authorities.Maggie Miller, Hackers release patient data stolen from New Zealand health systems, The Hill (26 May 2021) The data was later leaked into the dark web, affecting more than 4,200 people. Scott Yeoman, Waikato DHB to tell 4200 people their personal information was disclosed on the dark web, following May cyber attack, Stuff (10 September 2021); Natalie Akoorie, Waikato DHB cyber attack: Out of date software used by some staff, RNZ (4 November 2021)
Aftermath 	The attack was labeled as the “biggest cyber-attack in New Zealand history”. DHB’s chief executive stated repeatedly that the Board was not going to pay a ransom and that there was no further communication with the alleged hackers.Andrew McRae, Cyber attack: More to miss out on surgery as Waikato DHB rebuilds IT system, RNZ (24 May 2021) 
It took several weeks to restore the information systems and make them operational again. The Radiation Therapy was partially resumed at Waikato DHB on 7 June 2021 when the supporting system was restored and back online, and the work continued for weeks to restore all the impacted systems, prioritizing key services.Waikato DHB, Radiation therapy resumes at Waikato DHB for cancer patients (7 June 2021) On 21 December 2021, DHB stated that the hospitals’ services have returned to full functionality.Waikato DHB, Information System Outage and Cyber Security Latest (21 December 2021)
DHB was assisted by fourteen governmental agencies in the recovery, including the Ministry of Health, the police, the Department of Internal Affairs, the Government Communications Security Bureau and the National Cyber Security Centre.Natalie Akoorie, Waikato DHB cyber attack: Out of date software used by some staff, RNZ (4 November 2021) Alongside the recovery of the servers from the attack, the hospitals worked on enhancing the systems security and resilience before reinstated.Waikato DHB, Waikato DHB IT outage update (2 June 2021); Nikki Preston, Waikato DHB cyber attack: Hospital bosses fearful of copycat attacks and tipping hackers off, NZ Herald (3 March 2022) 
DHB received several queries regarding potential privacy breaches, and complaints have also been filed before the Privacy Commissioner. A criminal investigation of the attack was initiated.Waikato DHB, Waikato DHB Information System latest update (26 May 2021) DHB obtained High Court orders to prevent media organizations from using the breached information and to permanently delete any copies of the data from their systems.Waikato DHB, Information System Outage and Cyber Security Latest (2021); RNZ, High Court stops RNZ from using further information stolen in Waikato DHB cyber attack (4 August 2021) 
One of the several external forensic investigations was completed early in 2022.Nikki Preston, Waikato DHB cyber attack: Hospital bosses fearful of copycat attacks and tipping hackers off, NZ Herald (3 March 2022) DHB has decided not to release the findings as they included confidential information on data systems and in order not to encourage similar attacks.
Analysed in 	Scenario 14: Ransomware campaign
Scenario 20: Cyber operations against medical facilities
Collected by: Dominique Steinbrecher
Category:Example
Category:2021