'Cybersecurity incident' hampers non

Waikato District Health Board is in the throes of a recovery process that health organizations around the world have gone through during the pandemic.

Health officials in New Zealand have for multiple days been dealing with a “cybersecurity incident” that has hindered non-urgent care at multiple hospitals south of the capital of Auckland. Local media are reporting that ransomware is the cause.

The IT systems of Waikato District Health Board, which oversees health services for 425,000 people on New Zealand’s North Island, have been offline as government cyber officials investigate the cause of the incident.  The investigation is ongoing, “but [we] are working on the theory that the initial incursion was via an email attachment,” the health board said in statement Wednesday.

Emergency care continues, but the disruption has caused some elective surgeries to be postponed at one of the health board’s facilities, Waikato Hospital, “while a number of outpatient clinics have been reduced,” the board said. Some of the outpatient clinics that have been affected include those dealing with respiratory illness and infectious diseases.

Waikato DHB chief executive Kevin Snee said the process of fully restoring IT systems at the network of hospitals will likely extend into next week, the New Zealand Herald newspaper reported. Twenty cancer patients may need to be moved to facilities in other cities, the paper reported.

Waikato District Health Board is in the throes of a recovery process that health organizations around the world have gone through during the coronavirus pandemic, as cybercriminals have continued to lock up computers and demand a ransom. By the first week of December 2020, there were nearly double the amount of publicly reported ransomware attacks on health care providers compared to all of 2019, according to threat intelligence firm Recorded Future.

The apparent ransomware attack in New Zealand comes as the Irish public health system is trying to get back online following its own ransomware hack. Irish authorities have said it will take “many weeks” to fully restore computer systems following the hack, which has affected maternity care and chemotherapy, among other services.

Meanwhile, in the U.S., Scripps, a San Diego-based nonprofit system with five hospital campuses, has for weeks grappled with a “security incident” that knocked its IT applications offline and forced it to reschedule some patient appointments. The nonprofit’s website was back online Thursday after weeks of being down.

The unchecked ransomware attacks on health organizations during the pandemic has heightened pressure on governments to take action. A public-private ransomware task force has recommended that U.S. prosecutors prioritize and seek harsher punishments for ransomware cases that threaten public health and safety.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure