A crisis meeting has been held in Wellington as the Waikato District Health Board (DHB) struggles with the crippling hack of its IT systems, but it could be months before it's known who was behind the cyber attack.
Minister of Health Andrew Little says there is little headway in pinpointing those responsible for the ransomware attack, which targeted the DHB's computers a week ago. It's believed the hack was triggered when an email attachment was opened, releasing scores of personal documents and affecting services across the entire region.
Speaking to The AM Show on Thursday morning, Little said experts from the GCSB's National Cyber Security Centre have warned officials the identification process will take time.
"They tell me, look, it could be weeks, even months, before they will know - but that investigation is well underway," Little said.
The sabotage has caused chaos for the DHB, particularly in regards to cancer patients requiring urgent care.
While it was initially thought around 70 patients were affected by the data breach, the number is now understood to be higher, Little said.
"The Cancer Control Agency will step in today, making sure that referrals of patients that can't be treated in Waikato - who need more urgent treatment - can get that treatment with the same level of urgency, even if they have to go to a different hospital somewhere else in New Zealand," he told The AM Show.
But a trip across the Tasman is an "absolute last resort", Little said, reiterating that officials are still desperately trying to avoid sending cancer patients to Australia for treatment.
"We don't want people to go to Australia if we can possibly avoid it, that would be very much a last resort situation."
He said some patients had been referred to the DHB for treatment, but the hack prevented the referral from being processed or the information was lost.
"There are some patients that had been referred by their GPs to the DHB but the DHB still hadn't processed that referral, so they've lost that information," he said.
"There could be about 20 people affected in that respect."
The group claiming responsibility for the cyber attack emailed Newshub on Tuesday, saying they had obtained "a lot of personal info of employees and patients", as well as financial details.
They also declared "most" of the DHB's backups were deleted - and the systems can't be restored without their help.
"They decided to ignore us and torture their employees and patients. It is only their fault that DHB is still offline. They can't use their backups. We deleted most of it," the group said.
It said without their help, the DHB will have to rebuild their network from scratch.
Waikato DHB chief executive Keven Snee has previously said they wouldn't pay any ransom, but getting everything back online has taken longer than first expected.
Little agreed that resolving the damage is a work in progress.
"Last week, they thought they'd have everything fixed within a week. That clearly isn't going to happen," he told The AM Show.
"It's going to be longer. So we need to make sure the DHB's being properly supported to make sure the patients are getting the care and treatment they need."
He said recovery of the data is ongoing and a review into how exactly the attack occurred will follow.
