A cyber security incident affecting an IT service provider used by Te Whatu Ora has impacted access to some Te Whatu Ora data relating to bereavement and cardiac services.
Our cyber security team has been working with Government agencies and the affected IT service provider to determine the full nature, extent and potential impact of this incident. These investigations are at a very early stage and will take some time to complete.
The incident did not target Te Whatu Ora systems directly and we would like to reassure the public that there has been no disruption to health service delivery and that all Te Whatu Ora health services are continuing to run normally.
However, access to some information held by the IT service provider has been blocked, which means clinical teams and staff working in some areas cannot access certain types of data at present.
- Bereavement care services data from Middlemore Hospital in Auckland comprising approximately 8,500 records dating back to 2015.
- Cardiac Inherited Disease Registry data comprising approximately 5,500 records dating back to 2011. This registry is accessed by clinicians in Auckland, Wellington, Tauranga, Waikato, and Nelson.
While the above records are currently inaccessible, there is no evidence at this stage that they have been subject to unauthorised access or download.
In addition, the IT service provider’s incident has also affected six health regulatory authorities who have their services hosted by the IT service provider concerned. These authorities include (1) the Optometrists and Dispensing Opticians Board of New Zealand; (2) the Chiropractic Board; (3) the Podiatrists Board; (4) the New Zealand Psychologists Board; (5) the Dietitians Board; and (6) the Physiotherapy Board of New Zealand.
Te Whatu Ora has been in contact with each of these organisations to offer support and will continue to work closely with them.
Your questions answered
What has happened?
An information technology (IT) provider we work with has experienced a cyber security incident. We are working with them to identify if there is any potential risk to our information.
What kind of information has been affected?
The data relates to bereavement care services information from Middlemore Hospital in Auckland and the Cardiac Inherited Disease Registry.
Is my information safe?
Te Whatu Ora takes the safeguarding of information very seriously. We are working with the IT service provider and other Government agencies to understand the full nature, extent and potential impact of this incident.
How will I know if my information is safe?
We encourage anyone who is concerned about their information or a member of their whānau to please contact us on 0800 638 924 for any support they may need. This free help line will be operational from 8.30am on Wednesday 7 December 2022 and be available from 8.30am-5pm Monday to Friday thereafter.
What can I do to keep my personal information safe?
There are lots of ways to stay safe online, such as being cautious about clicking on links or attachments in emails from people you don’t know. Having a strong password is also effective, as is keeping your devices up to date with the latest operating system versions. More helpful resources about keeping safe online can be found on the Netsafe website.
Support is available
We understand that this situation may be distressing for people. We want to reassure the public that we are working swiftly with other Government agencies and cyber security experts to determine the full nature, extent and potential impact of this incident. As further facts are established, we will work to communicate these as swiftly as possible.
We encourage anyone who is concerned about their information or a member of their whānau to please contact us on 0800 638 924 for any support they may need.
This free help line is available from 8.30am-5pm Monday to Friday.
Members of the public are also welcome to contact IDCARE, a specialist support provider for people affected by cyber incidents. IDCARE can be contacted on freephone 0800 121 068 from 8.30am-5pm Monday to Friday or by visiting www.idcare.org/te-whatu-ora-health-incident-response.