Possible data breach at DHB provider

A data breach may have occurred at the organisation that provides health IT services to more than a third of the country, amid growing indications of a serious cyber-security incident.

A spokeswoman for the Office of the Privacy Commissioner said it was notified by the Counties Manukau District Health Board of a possible data breach on Wednesday.

The notification was made by the board on behalf of HealthAlliance, which also provides the IT services used by the Auckland, Waitemata¯ and Northland district health boards.

A spokesman for HealthAlliance said earlier that it had ‘‘identified indications of unusual activity on its technology systems’’.

An investigation was under way to understand and address the cause of the unusual activity, he said.

A spokesman for the Ministry of Health said it was ‘‘providing support to the investigation’’.

Comment has been sought from HealthAlliance on whether patient details may have been compromised.

Brett Callow, a cybersecurity expert at Nelson company Emsisoft, said ‘‘unusual activity’’ could suggest HealthAlliance was experiencing a ransomware attack or had noticed signs of compromise consistent with the early stages of such an attack.

HealthAlliance’s spokesman indicated there was nothing to link the activity to the attack on the Waikato District Health Board in May and said all northern region DHB IT systems were functioning normally.

HealthAlliance acknowledged the incident after Stuff was tipped off that district health boards had been briefed about what they understood to be a ‘‘significant cyber event’’.

The four DHBs supported by HealthAlliance together serve about 1.9 million New Zealanders.