Te Whatu Ora Covid-19 data breach: Social media threat to release private health information

Te Whatu Ora says a staff member has threatened to release private health information online in connection with a recent data breach.

Te Whatu Ora chief executive Margie Apa said the potential release of information breached an order that the Employment Relations Authority had made preventing the publication of the Covid-19 vaccination data.

She said the Covid-19 vaccination data set previously posted online included anonymised information on dates of when people were vaccinated.

She said the Covid-19 vaccination data set previously posted online included anonymised information on dates of when people were vaccinated.

Apa said Te Whatu Ora had taken action after the threat was made, including stopping the employee from accessing its computer systems, getting urgent orders from the Employment Relation Authority to stop the sharing of the information should it be released, and asking different websites and internet platforms from removing any information.

“Our investigation thus far has shown that with considerable effort, we believe someone with expert technical knowledge could potentially identify a very small number of individuals, some of these individuals are deceased,” she said.

“Once our forensic work is complete, we will contact the families of those that could be identified.”

She said their investigation so far had found the employee “inappropriately” sent other information to people outside Te Whatu Ora.

“There is no evidence at this time this information was shared publicly, or with other people, however we are working with experts to provide us with further assurance this information was not shared more widely,” Apa said.

Since Te Whatu Ora became aware of the breach, it disabled the employee’s access to its computer systems and information, notified the Privacy Commissioner and worked with the commission to appropriately respond, and “placed the highest priority on investigative work” including using cross-government skills and international expertise in cyber and data security.

“We wish to thank all organisations who have assisted us in some way, recognising the importance of protecting personal information. This includes government agencies and companies who have responded in a timely way to support our work,” Apa said.

“Alongside our operational response we are looking at our processes for data security and will make any changes that are needed to further increase the security of information.”

Former Te Whatu Ora employee Barry Young, 56, was charged with dishonestly accessing a computer in connection with the breach.

He pleaded not guilty yesterday in the Wellington District Court and was greeted with applause by his crowd of supporters in the public gallery, including high-profile conspiracy theorist Liz Gunn.

His lawyer, Matthew Hague, advised the court his client had elected trial by jury. Young is next due to appear in court on February 23.

Young was also interviewed by prominent American conspiracy theorist Alex Jones.

More to come