New Zealand Court Acts to Stop Spread of Hacked Medical Records

The New Zealand High Court has issued an urgent injunction barring the publication of stolen medical data after hackers accessed about 430,000 private patient documents held on a health portal used by more than a third of the country’s population.

Hackers calling themselves the Kazu Group accessed health records on the Manage My Health website last week and threatened to publish them on online forums unless a “confidentiality fee” of $60,000 in bitcoin was paid, according to a High Court judgment released in Wellington on Wednesday.

The injunction, issued by Justice Isac, prevents anyone from accessing, storing, broadcasting or publishing the stolen material. The judgment said little is known about the hackers, other than that they are likely based overseas.

Manage My Health, which is owned by an Auckland businessman, didn’t reply to a request for comment.

The website and mobile app is one of New Zealand’s most popular patient management systems, with about 1.8 million people using it in a country of 5.3 million. About 127,000 patients are potentially impacted by the attack, according to the judgment.

The breach is the second major cyber incident to affect the nation in recent days. The local networking website Neighbourly said last week it had been notified that a large database of member information was being offered for sale on the dark web. The High Court has also granted an application aimed at preventing access to that data.

On Monday, Health Minister Simeon Brown commissioned the Ministry of Health to review the response to the Manage My Health cyber-security breach.

“Patient data is incredibly personal and whether it is held by a public agency or a private company, it must be protected to the highest of standards,” he said in a statement.

The stolen files include highly sensitive descriptions of patients’ health conditions, medical histories and medication records, according to the judgment.