The medical and personal information of about 1 million people was exposed after a breach of Tū Ora Compass Health, a primary health organization (PHO) located in New Zealand.
The non-governmental organization (NGO) discovered four intrusions – by what Ministry of Health Director-General of Health Ashley Bloomfield said were two hacktivists and two “more sophisticated actors” – on August 5 after its website was defaced.
The breach “illustrates how third-party healthcare cybersecurity remains a pressing problem throughout the world,” said Elad Shapira, head of research at Panorays, who noted that Tū Ora connected to 60 different general practice teams and other health providers and, like other healthcare companies, collected “some of our most sensitive and confidential data: personal and demographic information, financial statements, health details and insurance policies” that attackers can use for identity theft, insurance fraud, financial gain and blackmail.
“Amassing hundreds of thousands of patient records in a single database increases the risk of compromising patient data should a breach occur,” said Paul Edon, senior director (EMEA) at Tripwire.
Tū Ora has retained data on patients “dating back to 2002, from the greater Wellington, Wairarapa and Manawatu regions. Anyone who was enrolled with a medical center in that period could potentially be affected,” a New Zealand Herald report cited a Tū Ora press security incident advisory as saying, noting that while the current population of those regions was around 648,000, the list of those affected included people who are deceased or who have moved, bringing the total to about 1 million.
“According to the data breach statement, 17 years’ worth of personal data was potentially accessed not once, but four times before detected,” said Jonathan Deveaux, head of enterprise data protection at comforte AG. “Unfortunately, there did not seem to be protections placed on the data itself, which means the personal data was left in clear text form. It’s a good thing that no payment info, tax numbers, passport numbers, nor driver’s license numbers were on the server; otherwise, those data elements would have been exposed as well.”
Securing patients’ data requires healthcare organizations to “go beyond simply being compliant with security frameworks and ensure that their environment is duly protected against unauthorized changes and misconfigurations which can make their environment susceptible to a cyberattack,” said Edon. “Given the increased cyberattacks against healthcare organizations, it is simply no longer sufficient to be merely be compliant with security frameworks. When retaining this kind of data it is critical to choose an encryption solution that not only protects the database instances but also provides protection for data in transit and at rest.”
