Clinical trials provider latest health sector organisation to suffer cyber breach

NEWS - eHealthNews.nz editor Rebecca McBeth

Police are investigating and Health New Zealand is supporting a Dunedin-based clinical trial service provider as it responds to a cyber incident in which it appears health information has been stolen and posted online.

Zenith Technology, or ZenTech, is a privately owned and operated Dunedin-based contract research organisation (CRO) involved in clinical-trial related work with Health NZ and the wider health sector.

A Health New Zealand spokesperson says the organisation was made aware of a cyber incident after files attributed to ZenTech were identified online.

Health New Zealand is supporting the CRO with its response and ZenTech has also engaged specialist cyber forensic support.

“There is no impact on Health NZ digital systems, and hospitals and primary care providers are operating as normal,” the Health NZ spokesperson says.

“We recognise the public interest in this incident and the concern cyber events can cause. Our priority is to ensure the response is thorough, coordinated and based on verified information.”

Health NZ says the right agencies and specialist experts are involved, and the situation is being actively managed through established national incident response protocols.

"This is also an ongoing Police investigation, meaning there are limits to what can be said publicly while the investigation and related forensic work continue,” says the spokesperson.

“Where any information is confirmed that indicates risk to individuals, Health New Zealand will work with the impacted organisation and relevant agencies to ensure appropriate steps are taken to notify and support those affected."

ZenTech's website says the CRO provides clinical trial and analytical laboratory services for the international pharmaceutical industry.

A statement from the company reported in Stuff says it has taken certain systems offline while working to ensure their IT environment is secure and the incident has been contained.

“We are aware that some sample material purported to be company data has been published online. As a matter of priority, we have engaged independent cyber security experts to investigate the incident and assess the nature and extent of any impact,” it says.

New Zealand’s health system has been hit by a number of high profile breaches this year, including at patient portal provider Manage My Health, digital medication management platform MediMap and private healthcare provider IntraCare.

Altersec chief executive Faustin Roman said in March that having a cluster of breaches follows a predictable pattern which he described as a "feeding frenzy", where attackers target sectors with demonstrated weak defences and minimal consequences.
  

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page