Communication Criticized in Handling of Recent Healthcare Hack

"Manage My Health, a portal enabling connection between individuals and their healthcare providers, experienced a cyberattack identified on Dec. 30. The New Zealand-based organization published a statement to its website the following day, and as of Jan. 5, has continued to post subsequent updates as information has come available. Following the forensic investigations, the organization believes around 7% of 1.8 million registered patients may have been impacted."

"While it appears that hackers were able to access a specific collection of documents within the organization's system, it does not appear that they accessed the main patient database or any credentials. Moreover, no evidence has been found to suggest that data was modified or destroyed. According to RNZ, on Jan. 4, cybercriminals calling themselves Kazu claimed the attack and asserted that "unless the company paid a ransom within 48 hours, they would leak more than 400,000 files in their possession.""

""We acknowledge we could have done a better job at communication, however, our priority was to secure patient data and work on the accuracy of all information before providing it to practices and patients. This has been our paramount consideration," Manage My Health said in a statement on its website. "As we have said from the beginning, we strive to be transparent in our communications, and will be publishing daily updates with all the information we can share with you."

Manage My Health identified a cyberattack on Dec. 30 and began posting updates from Dec. 31 through Jan. 5. Forensic investigators estimate roughly 7% of 1.8 million registered patients may have been affected. Hackers appear to have accessed a specific set of documents, but investigators found no evidence that the main patient database or credentials were accessed, nor that data were modified or destroyed. A group calling itself Kazu claimed responsibility and threatened to leak more than 400,000 files unless a ransom was paid. The organization says it prioritized securing data and accuracy and is informing affected practices and patients.

Read at Securitymagazine