Waikato doctors go old school while teams face 'demanding' task of recovering IT systems following cyber attack

Wednesday, 19 May 2021

Outpatient appointments and patients coming for a non-urgent surgery have been affected.

A doctor at Waikato Hospital says staff are going back to processes used 20 years ago to make it through a cyberattack that’s crippled its IT systems.

And an IT expert says cybersecurity teams face a hugely “demanding” process to recover the DHB’s infected software.

The doctor, who Stuff has agreed not to name, said hospital staff were using whiteboards as a way to record patients’ names.

Without electronic systems, it was “very challenging” to keep track of patients in a busy emergency department with 80 to 90 patients.

* Ministry of Health launches sweeping review of Covid-19 vaccine booking systems

* Microsoft email users in NZ told to act quickly after mass hack

A Waikato Hospital emergency doctor said staff are recording patient names on whiteboards as a way to make it through the disruption.

The DHB was the victim of a major cyberattack on Tuesday morning, which crashed its electronic systems, delayed some elective surgeries and made patient's notes inaccessible.

Medical staff were recording all notes manually and had to be vigilant there were no mistakes.

“We are going back to processes a little bit like we used 20 years before computers were used in these sorts of settings,” the doctor said.

Hospital staff were used to electronic processes where they can access a patient's history through the National Health Index (NHI).

Auckland University of Technology professor of computer science Dave Parry said teams restoring the Waikato DHB needed to be careful malware hadn't been backed-up on the system, leaving the hospitals vulnerable to another attack.

“We’ve got to make sure communications are really tight between departments and making sure when you are handwriting details on a lab form you are not making mistakes.”

Hospital receptionists had a particularly difficult task in making sure all patients were identified correctly.

“We still have some of the older, hard copy material from patients.”

The hospital dealt with a number of emergencies on Tuesday night, including trauma injuries from car crashes.

“The cath lab is working, the CT scanner is working, the operating theatres are working.

There could be days of disruption while IT teams face a daunting and extensive task of recovering all electronic systems after a crippling cyberattack.

“We are rolling our sleeves up, and making it work, and we’re hopeful it will be fixed.”

But AUT Computer Science professor Dave Parry said recovering systems after such an attack, took a significant amount of time.

The experts tasked with recovering the hospitals’ systems faced a 'demanding process”.

Earlier, Waikato DHB chief executive Kevin Snee told RNZ the attack had most likely been installed through a malicious email attachment.

Jacinda Ardern said the country is likely to “continue to face attacks like this as we’ve seen other countries have too.” (File photo.)

“The email will have installed software the attackers are using and that software will be doing the attack, either encrypting the files or deleting files or trying to make a connection.”

The experts had to shut down all systems so the malware wasn't running, delete the malware, then restore any of the DHBs back-up files.

The Irish health system is facing massive ongoing disruption from cyberattacks in recent days. The attack has encrypted patient files and those behind it have demanded a ransom.

Parry said teams had to be careful the malware hadn’t been backed-up on the system, which could leave the DHB vulnerable to a second attack.

“When you need to restore the system, you then may be restoring the malware. That may have happened in Ireland.”

When asked whether other New Zealand DHBs could be attacked, or whether the Waikato DHB could be attacked again, Parry said the risk was “probably quite low”.

“There is a constant stream of attacks coming in and this one just happened to get through.”

The Prime Minister weighs in

Prime Minister Jacinda Ardern said the Waikato DHB was facing a “very difficult situation”

We want to get the DHB back on a “firmer footing after what has been a disruptive event”, she said.

Ardern said the event was a reminder for the public or private sector to have good contingency plans and be prepared.

“We are going to continue to face attacks like this as we’ve seen other countries have too.”

Health and GCSB Minister Andrew Little said Waikato DHB had accessed help from the National Cyber Security Centre and the GCSB for the attack.

Little said the different DHBs’ IT infrastructure was “fragmented and overly complicated.”

'There are always security challenges with IT systems.

“Connecting and upgrading health IT systems is a key objective of the Health and Disability System reforms.'