Waikato DHB enters third day affected by cyber attack

The embattled Waikato District Health Board (DHB) is entering its third day today with its IT systems down because of a crippling cyberattack.

Waikato DHB chief executive Kevin Snee told Morning Report he was still unsure if its hospitals would be back to normal by the weekend.

"It is likely to run into and beyond the weekend but we're uncertain when it will reach resolution - that will become clear over the next 24 to 48 hours."

Read also: Ransomware: What you need to know

He said as many as 20 cancer patients may need to be transferred to Auckland or Tauranga, but the DHB was trying to get radiotherapy services up and running.

"The majority of elective surgery is going ahead. We're dealing with almost 85-90 percent of elective surgeries going ahead at the moment. The majority, two-thirds, of outpatients, are going ahead ... if it's one that requires significant digital imaging, cardiology for example, then we will rebook those people ... mental health is going ahead as normal."

Snee said cyber experts were working to isolate the problem and reset individual computer systems as quickly as possible, but they were complex systems.

He could not comment on the ransomware as it was now under police investigation.

British cybersecurity firm Sophos incident response manager Peter MacKenzie said hackers would have spent weeks preparing to breach the Waikato DHB's IT systems.

"If this is a Conti ransomware attack - I'm not involved in this instance specifically - but probably about 90 percent of the Conti ransomware attacks my team has investigated, they have taken data prior to launching the ransomware."

He said dealing with a Conti hack would be the hardest feat New Zealand cyber security experts would have dealt with.

'Full domain compromise'

Auckland based Theta cyber security head Jeremy Jones told Nine to Noon IT systems in the health sector were a complex environment.

"Health information systems are incredibly complicated, there's all sorts of things that are integrated ... possibly running on legacy infrastructure and it is just a huge job maintaining all of it. There's arguably not a single solution here."

Jones said a natural tension between the health ministry and DHBs did not help.

He questioned whether the ransomware attack came through an email attachment as suggested by the DHB, adding that is was less common in modern cyber crime.

"What we're seeing nowadays is a ransomware attack is a result of what we call a full domain compromise. There's almost no malware or viruses involved in the attack whatsoever. The hackers are literally controlling your network from abroad."

Jones was formerly a cyber warfare operations officer at the UK Ministry of Defence.

Doctors at Waikato Hospital are reverting to whiteboards and hardcopy records to continue treating patients.

A doctor working at Waikato Hospital's emergency department yesterday said they were rolling up their sleeves and dealing with the crisis - like it is 1999.