‘Hot chilli’ simulates major cyberattack on health

Return to eHealthNews.nz home page

eHealthNews.nz editor Rebecca McBeth 

The Northern Region simulated a major cyberattack on its health system, saying it’s a case of “when, not if” an attack will eventually occur.

health Alliance systems operations manager Simon Long presented at the HiNZ Conference 2018 in Wellington on 23 November on the mock incident, called ‘hot chilli’, which was run by the shared services agency.

He said low-scale cyberattacks on the health system happen on a daily basis and the mock incident escalated the scenario into a major attack that affected a number of systems.

“The objective was to create, test and improve a regional view of business continuity and the recovery capability,” he told attendees.

The exercise involved the four northern district health boards – Waitemata, Auckland, Northland and Counties Manukau – and was designed to be as close to real life as possible, so staff were not forewarned. Around 27,000 people work across the DHBs and healthAlliance.

The mock attack involved the email systems being unavailable due to hacking, no wifi access on the sites and the data integrity of the clinical systems being untrustworthy, meaning National Health Index numbers were not validated.

The simulation started at 9am and finished around 4pm followed by a debrief and “it was a really interesting day for everybody involved,” said Long.

Key learnings were that you can never over-communicate in a crisis situation and the huge value of practice to get better and become more efficient.

Long said other organisations had since asked healthAlliance for help in this area and the agency is happy to share its learnings.

Ministry of Health chief security adviser Nick Baty presented with Long on his involvement with ‘hot chilli’ and how the experience has fed into the development of a health sector cybersecurity event response plan.

Return to eHealthNews.nz home page