A group claiming to be behind the cyber attack on the Waikato District Health Board (DHB) says "most" of the backups were deleted, and the systems can't be restored without their help.
The group, which emailed Newshub on Tuesday, also said they obtained "a lot of personal info of employees and patients" as well as financial details.
"For Last 3 days we tried to contact them, and we offered help with restoring the network [sic]," the email - signed 'Judith Williams', presumably an alias - said.
"With our help they could restore it for 1 day. Without our help they will have to rebuild their network from the beginning. They decided to ignore us and torture their employees and patients. It is only their fault that DHB is still offline. They can't use their backups. We deleted most of it."
The DHB's computers were targeted in a ransomware attack a week ago, believed to have been triggered when someone opened an attachment they shouldn't have. Waikato DHB chief executive Keven Snee has previously said they wouldn't pay any ransom but getting everything back online has taken longer than first expected.
He told the New Zealand Herald, which also received the email, that it had been forwarded to police, and would not comment on whether the DHB had any communication with the hackers. Police said the email was "being assessed".
The email contained a link, supposedly showing "what kind of documents they lost". Newshub did not try to open the link.
The person who sent the email said they were giving the DHB one more day to get in touch.
"For us there is no cyber war, just a business. They have a lot of budget money. That amount has to be spent to save people's lives. Now it's time when they can save no one and they don't want to pay.
"They lie to you that their job is helping people. They allow themselves to steal budget money, but they don't allow themselves to spend it to restore their hospitals.
"Backups are gone, information gone. They understand the situation. Waikato DHB cannot be fully restored without us."
The GCSB's National Cyber Security Centre (NCSC) said "malicious actors can monitor what is being said in the media, and this can influence their behaviour.
"For this reason we will not be providing any further comment at this time about our incident response."
Services at the DHB's hospitals continue to be disrupted, with around 20 percent of elective surgeries and outpatient clinics being postponed or cancelled.
Snee on Monday said it could be weeks before services are restored back to normal.
"We're a very complex system and this has proved more complex to address than was first thought," Snee told RNZ. "We also have to be careful in addressing the problem that when we stand up the system, it doesn't run into problems again."
