Waikato DHB wins injunction to stop Radio NZ using hacked data

Wednesday, 4 August 2021

Waikato DHB has succeeded in gaining an injunction to stop Radio NZ from using hacked information.

Waikato District Health Board has succeeded in court action to stop Radio New Zealand using data taken in a cyber-attack.

In a decision released on Wednesday, the health board has won an interim injunction through the High Court restraining Radio NZ from accessing stolen data without consent and to permanently delete that data or any copies.

In May, the Waikato DHB was subject to a cyber-attack by unknown criminals, believed to be operating from overseas.

It included personal patient health information, employee information and commercially sensitive operational information. The DHB refused to pay a ransom and some of this information was subsequently sent to media and portions were released on the dark web.

* Cyber attack: Waikato DHB hopes to have computers running at its hospitals in the next two days

* Hackers heap misery on Waikato DHB cancer patients

Radio NZ recently published a story about a child whose case was being handled by Oranga Tamariki. The story did not contain any personal information about the child other than their length of stay in the hospital.

The DHB had warned the state broadcaster about its concerns about media accessing illegally obtained data and after the story was published, sought an injunction against its further use.

The DHB argued that Radio NZ’s refusal to hold off on publishing the information, meant it was unable to contact the child or their whānau or caregivers before publication.

It also said that although the child was not expressly named in the Radio NZ publications, it was “easily identifiable in the Radio NZ stories by those who know of the child or their circumstances”.

In the decision, Justice Churchman ruled Radio NZ, other partnered media organisations and “unknown second defendants”, effectively the still-at-large hackers, from holding, copying or using any of the data taken in the cyber-attack.

“In terms of where the overall justice of the matter lies,” the judgment said, “there are strong arguments to the effect that it is not in the public interest that the confidentiality of the private, personal and sensitive information in the stolen dataset be breached.

“Equally, there are public policy arguments against permitting unknown defendants to attempt to profit in a way which assists extortionists to inflict maximum pressure on their victim to comply with their ransom demands.”

The decision did not apply to stories already published.

Radio NZ was ordered to destroy the material. The affected parties have four days to challenge the decision.