'Indications of unusual activity' detected by northern region DHB IT service, 'no link' to recent Waikato ransomware attack

An organisation providing health IT services to District Health Boards (DHBs) in New Zealand's northern region has confirmed it has recently identified "indications of unusual activity" on its technology systems.

HealthAlliance, which services the Auckland, Northland District, Waitematā, and Counties Manukau District Health Boards, confirmed it picked up on the activity during regular routine security monitoring practice.

"An investigation is underway to understand and address the cause of the indications of this activity," a spokesperson told Newshub.

"The investigation so far has had no impact to health services. All Northern region DHB IT systems are functioning normally."

They said there is nothing to link the investigation into the activity to other cyber security incidents including a ransomware attack which forced Waikato DHB to shut down its IT systems. 

"Given our investigation and the risks around public commentary we are not able to provide further comment at this time."

A Ministry of Health spokesperson confirmed it had been informed about the activity by HealthAlliance.

"The Ministry is providing support to the investigation underway to understand and address the cause of the indications of this activity."

The Office of the Privacy Commissioner told Stuff the activity was a potential data breach.

Cybersecurity expert Brett Callow said "indications of unusual activity" could indicate that HealthAlliance was either experiencing a ransomware attack or had noticed potential indicators of what could turn into one.