{"id":13164,"date":"2025-03-28T05:55:24","date_gmt":"2025-03-27T16:55:24","guid":{"rendered":"https:\/\/thebuzz.apnanetwork.co.nz\/?p=13164"},"modified":"2025-03-28T05:55:24","modified_gmt":"2025-03-27T16:55:24","slug":"former-health-nz-it-worker-not-surprised-at-data-breach","status":"publish","type":"post","link":"https:\/\/thebuzz.apnanetwork.co.nz\/?p=13164","title":{"rendered":"Former Health NZ IT worker ‘not surprised’ at data breach"},"content":{"rendered":"

Health NZ is refusing to confirm whether the “malicious actor” behind a\u00a0data breach<\/a>\u00a0involving staff’s personal health information was an external hacker or an inside job.<\/p>\n

However, a former IT staffer from the affected region – who RNZ has agreed not to name – said many systems “across the motu” were vulnerable to attack due to staff shortages and deferred upgrades.<\/p>\n

The agency informed current and former staff at Capital, Coast and Hutt and Wairarapa on Thursday about the breach in October.<\/p>\n

It involved occupational health and safety information about staff, including what the agency described as “sensitive personal information”.<\/p>\n

Health NZ’s interim human resources officer Fiona McCarthy said it was “not a system-wide issue” and the health information of members of the public was not affected.<\/p>\n

“The incident happened late last year and as soon as we became aware, we took immediate steps to secure our systems and launch an investigation,” she said.<\/p>\n

“We deeply regret that this has happened, and we sincerely apologise to any of our staff who may be affected.”<\/p>\n

A systems engineer, who worked for Health NZ until earlier this year, said he was still waiting to hear if he had personally been affected by the breach – but was “not surprised” that it had happened.<\/p>\n

While he was not part of the investigation into the breach, he had been aware of it.<\/p>\n

“They need more engineers. I had a discussion with my team leader, and he agreed we needed about 50 more people who know what they’re doing, looking after Capital and Coast, Hutt and Wairarapa.”<\/p>\n

It was “a fairly small team” doing its best to secure ageing infrastructure, he said.<\/p>\n

“It’s all well and good to merge ‘the business’ [turn 20 district health boards into a single agency] but exponentially more complicated to merge the IT.<\/p>\n

“You’re talking about very large, complex, regional wide-ranging infrastructure with millions, even billions, of moving parts: all those systems, all those archives, all those databases over so many years – and lots of people with access.”<\/p>\n

Furthermore, there was not enough investment for upgrades, he said.<\/p>\n

“We didn’t get the funding to do as many of the upgrades as we wanted to do, so the result is a hodge-podge over time, and insecure systems.”<\/p>\n

Many IT staff were leaving Health NZ, even before the final confirmation of cuts to data and digital, he said.<\/p>\n

“A lot of people are upset at the changes.”<\/p>\n

RNZ asked Health NZ for its response to the ex-worker’s claims about IT staff shortages and requests for resources being declined, but was told it had “nothing further to add to the statement at this time”.<\/p>\n","protected":false},"excerpt":{"rendered":"

Health NZ is refusing to confirm whether the “malicious actor” behind a\u00a0data breach\u00a0involving staff’s personal health information was an external hacker or an inside job. However, a former IT staffer from the affected region – who RNZ has agreed not to name – said many systems “across the motu” were vulnerable to attack due to […]<\/p>\n","protected":false},"author":6,"featured_media":13165,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[222,174],"tags":[],"class_list":["post-13164","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-latest-news","category-nz-news"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=\/wp\/v2\/posts\/13164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13164"}],"version-history":[{"count":1,"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=\/wp\/v2\/posts\/13164\/revisions"}],"predecessor-version":[{"id":13166,"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=\/wp\/v2\/posts\/13164\/revisions\/13166"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=\/wp\/v2\/media\/13165"}],"wp:attachment":[{"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thebuzz.apnanetwork.co.nz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}