Speaker 1: Kyoda.
Speaker 2: I'm Chelsea Daniels and this is the Front Page, a
Speaker 2: daily podcast presented by the New Zealand Herald. A major
Speaker 2: online security breach has raised questions about how safe our
Speaker 2: private information is online.
Speaker 1: Manage my Health's health.
Speaker 2: Portal systems were compromised over the new year, putting the
Speaker 2: data of over one hundred and twenty thousand users at risk. Later,
Speaker 2: we'll check in with internet security expert black Veils Adam Burns,
Speaker 2: who immediately identified flaws in the website, which isn't unusual
Speaker 2: for Kiwi domains.
Speaker 1: But first on the front.
Speaker 2: Page ends at Herald's senior reporter, David Fisher, has been
Speaker 2: following the breach and will break down what happened and
Speaker 2: who is behind it.
Speaker 1: So David, let's start at the beginning.
Speaker 2: What exactly happened in the Manage my Health breach and
Speaker 2: what even is it?
Speaker 3: To Manage my Health is a patient health information database
Speaker 3: connection point where health services can upload and put information
Speaker 3: specific to an individual's account. Of patient's account, I, for example,
Speaker 3: have a Managed my Health account. I get a regular
Speaker 3: blood test done and the lab results they get posted
Speaker 3: in the Manage my Health account for me to see
Speaker 3: them at the same time as the doctor does, right.
Speaker 2: And it's kind of one of those things where like
Speaker 2: if you need another prescription field or something, you just
Speaker 2: log in to Manage my Health and ask for another prescription.
Speaker 1: Stuff like that.
Speaker 4: The idea is that you automate everything.
Speaker 3: Yeah, and some parts of the country don't have quite
Speaker 3: so much technology wrapped around their health services. North And
Speaker 3: for example, I suspect it's been particularly hard hit because
Speaker 3: that's the case there. The idea is to collect all
Speaker 3: the information that a patient needs to know and that
Speaker 3: their medical professionals need to know in one place, and
Speaker 3: it's a widely used service too. Manage my Health on
Speaker 3: its landing page on its web page says it is
Speaker 3: trusted by one point eight million New Zealanders to look
Speaker 3: after their health records.
Speaker 2: Right, So this latest breach, tell me a little bit
Speaker 2: about it, How did it come about and how many
Speaker 2: people are potentially affected.
Speaker 3: First sign of the breach was picked up by Managed
Speaker 3: my Health on December thirty and they realized or recognized
Speaker 3: that they had had unauthorized access to their platform. That
Speaker 3: suspicion became concrete the day after December thirty one, when
Speaker 3: Managed my Health received and email from somebody who had
Speaker 3: claimed they had a leak. They posted a sample of
Speaker 3: the documents that they claimed have been leaked to them
Speaker 3: on a site where these things are posted, and they said,
Speaker 3: we'll keep it quiet and the documents will never see
Speaker 3: the light of day if you give us sixty thousand
Speaker 3: dollars us What.
Speaker 1: Kind of information are we talking about here?
Speaker 3: So the sort of information is quite specific actually, and
Speaker 3: where you're going to manage my health.
Speaker 4: There's a range of different.
Speaker 3: Menus that you can click on, for example, the lab
Speaker 3: results one which I mentioned earlier for me, and prescriptions
Speaker 3: and so on. But there's also a part of the
Speaker 3: website which deals with clinical documents, and these documents that
Speaker 3: are scanned and then uploaded onto the site. So this
Speaker 3: is the part that was hit. Managed by Health says
Speaker 3: it's about six to seven percent of the users that
Speaker 3: were affected by this. That works out to be between
Speaker 3: one hundred many one hundred and thirty thousand people in
Speaker 3: court filings to get the injunction to suppress the information
Speaker 3: Manage my Health site at one hundred and twenty seven
Speaker 3: thousand people. So the type of information that gets scanned
Speaker 3: that you could find on there is clinical discharge summaries,
Speaker 3: referral notices to specialists. There could be historical referral records,
Speaker 3: information that patients have uploaded themselves that they want other
Speaker 3: medical specialists to see. It could also have diagnoses of
Speaker 3: your situation. It can have medical histories, there care plans,
Speaker 3: dates of birth addresses, other personal information. If it is
Speaker 3: the case as it is in the region of New
Speaker 3: Zealand that I live, and that your health services aren't
Speaker 3: particularly joined up. In a technical sentence, you're more likely
Speaker 3: to have uploads like that happened, where your medical professional
Speaker 3: will produce a letter that might be said to you
Speaker 3: in the post, but they will also scan it and
Speaker 3: upload it and to manage my health.
Speaker 4: That's the information that's been taken.
Speaker 2: Yeah, and you mentioned that Northlanders are particularly badly hit.
Speaker 4: Yeah, that's right.
Speaker 3: The thought is that it's about eighty five thousand I think,
Speaker 3: with a number of people in Northland that were said
Speaker 3: to be affected by this, that is a hugely disproportionate number.
Speaker 3: And I've not seen in explanation as to why that
Speaker 3: might be, but I do suspect that it is that
Speaker 3: gap in technology Northland healthcare. It's stretched, it's very stretched,
Speaker 3: and it has been for a very long time, and
Speaker 3: it is hard for GPS to make a go of
Speaker 3: a surgery up here. It's hard for surgeries to get
Speaker 3: GPS to work at them. A lot of the infrastructure
Speaker 3: is quite aged and quite dated. So to my mind,
Speaker 3: that would lend itself to a scenario where more information
Speaker 3: was produced in hard copy and then uploaded, sort of
Speaker 3: kind of like talking to your parents about how to
Speaker 3: do email stuff where they will write up a letter
Speaker 3: on a computer, print it out, scan it, and then
Speaker 3: attach it to an email and send it to you.
Speaker 2: Oh no, my mom takes photos of things and sends them.
Speaker 4: To me, exactly that kind of thing.
Speaker 2: What do we know about this group or the people
Speaker 2: that are responsible for this hack or say that they're
Speaker 2: responsible for this hack?
Speaker 4: So the person that.
Speaker 3: Individual that has claimed responsibility is an individual called Kazoo
Speaker 3: ka Zu.
Speaker 4: That's a handle rather than a name. They say that
Speaker 4: they are an individual rather than a.
Speaker 3: Group in that that handle is relatively it's only been
Speaker 3: in existence for the last six months. And I contacted
Speaker 3: the person claiming to be that hacker, interviewed them via
Speaker 3: a telegram the social messaging app, and they had said
Speaker 3: that they had gone out on their own. Prior to that,
Speaker 3: they operated by a different handle, and by inference we're
Speaker 3: more a part of a collective back then. We do
Speaker 3: know that they have been involved in other hacks or
Speaker 3: that they have been the recipient of hacked information in
Speaker 3: the past.
Speaker 4: They've said to me that.
Speaker 3: They have received payments for that and that it is
Speaker 3: a viable business model for them, that they look for
Speaker 3: health information as a particular thing that they do seek out,
Speaker 3: and having sought that out, they say that it's not
Speaker 3: unusual to their extract money as a result of having
Speaker 3: obtained that information.
Speaker 2: Yeah, and when it comes to the money, do we
Speaker 2: have any idea if that sixty thousand US has been
Speaker 2: paid out or not.
Speaker 4: We don't know.
Speaker 3: We do know that Kazoo claimed to be in negotiations
Speaker 3: last week. I suspect that the time that was brought
Speaker 3: for negotiations was probably more managed by Health's favor for
Speaker 3: cybersecurity people to try and track down Kazoo, perhaps even
Speaker 3: our GCSB.
Speaker 4: Who knows.
Speaker 3: But it's very often left unknown whether or not these
Speaker 3: payments are made, and there have been places in the past,
Speaker 3: not necessarily New Zealand, who have denied making payments and
Speaker 3: then evidence has emerged later that they have done these
Speaker 3: places are in a terror bind. One of the things
Speaker 3: that was puzzling about the Kazoo hack was that the
Speaker 3: amount of money was seen as very small for the
Speaker 3: sort of information that was available. I'd talk to Kazoo
Speaker 3: about that, and what was relayed back to me was
Speaker 3: that that's part of the model. Don't make it too painful,
Speaker 3: make it easy. And as that said to me, they're
Speaker 3: only in it to make money. They don't want to
Speaker 3: create obstacles with barriers that are going to get between
Speaker 3: them and the cash that they're after.
Speaker 2: It is a real catch twenty two, isn't it? Like
Speaker 2: the whole thing? Do not negotiate with terrorists. So that's
Speaker 2: probably a pretty good reason as to why we don't
Speaker 2: say if we've paid or not, because then others around
Speaker 2: the world would be like, hang on, New Zealand's a
Speaker 2: place where they pay out pretty easily.
Speaker 3: That's exactly right, and you become a target for further problems,
Speaker 3: and that's not the kind of attention that we want.
Speaker 5: Nothing is one hundred percent secure. We are secure to
Speaker 5: the best of our knowledge, and we do all the
Speaker 5: professional test which any industry assessment will make independently that
Speaker 5: we were a secure software. I'm a victim of the hack.
Speaker 5: My personal record is out there right, and so's lots
Speaker 5: of my friends and families. I am deeply distressed that
Speaker 5: this is out there and this has happened on software there.
Speaker 5: Our company has worked pretty hard to serve deeple.
Speaker 1: In terms of Manage my Health.
Speaker 2: Manage my Health has described itself as a victim of
Speaker 2: crime while also admitting that it did drop the ball.
Speaker 1: Where do you see.
Speaker 2: The line between being a victim and being responsible.
Speaker 3: Well, the victims here are managed by Health's clients patients.
Speaker 3: The one that the information belonged to Managed my Health
Speaker 3: has in my view, created a situation where they have
Speaker 3: been whacked. The Privacy Actor is pretty clear on this.
Speaker 3: If you look after people's information, you are responsible for
Speaker 3: creating an environment in which that information is going to
Speaker 3: be safe. So that is your job, and that was
Speaker 3: managed by Health's job. They should have created an environment
Speaker 3: in which no hacker could get to that information. So look,
Speaker 3: I'm very sad and sorry for Manage my Health. But
Speaker 3: if Managed my Health was able to produce evidence that
Speaker 3: they had a Fort Knox like security around patient information,
Speaker 3: then that sympathy that I have might be a little
Speaker 3: bit more than fleeting by sympathies with the patients. It's
Speaker 3: with those people whose information has been obtained by others.
Speaker 3: And I've spoken to people who have lost day believe
Speaker 3: incredibly incredibly personal information and really are having trouble getting
Speaker 3: through the day and sleeping at night as a result
Speaker 3: of it being out there.
Speaker 1: So where do we go from here?
Speaker 3: There's a government investigation under way, as ordered by a
Speaker 3: Ministry of Health Sibby and Brown, and there's also a
Speaker 3: Officer of the Privacy Commissioner investigation under the way as
Speaker 3: well that we'll be looking as to whether Manage my
Speaker 3: Health met its responsibilities under the Privacy Act. In terms
Speaker 3: of the investigation order by Simmy and Brown, I would
Speaker 3: have thought that the Ministry of Health would have required
Speaker 3: Managed my Health to meet some pretty stringent security standards
Speaker 3: to be able to set up and run the business
Speaker 3: that they have set up and run. If those weren't
Speaker 3: part of the baseline expectation, and if there wasn't auditing
Speaker 3: around that, then I think that question does come back
Speaker 3: to the Ministry of.
Speaker 4: Health as well.
Speaker 3: You know, if we're going to allow a situation where
Speaker 3: private providers can step in and take hold of what
Speaker 3: has traditionally been a state job. Then they've got to
Speaker 3: be held to really, really high standards, and we're going
Speaker 3: to make sure that they're audited to ensure that they
Speaker 3: stay at those high standards. So this business will have
Speaker 3: quite a way to run in terms of accountability. In
Speaker 3: terms of tracking down Kazoo, I think probably the same
Speaker 3: chance as a snowball on any of the days that
Speaker 3: we're having now. And for the patients and their private information.
Speaker 3: Who knows Kazoo has said that if the money gets paid,
Speaker 3: then that information will never be seen again. They do
Speaker 3: have a track record of that, but that record is
Speaker 3: only six months long. The other thing about it, too,
Speaker 3: is that there's so much useful information in there to
Speaker 3: other people of Kazoo's ilk, other people who will dates
Speaker 3: of birth or travel information, passport information, address information, all
Speaker 3: those personal indicators that they're incredibly, incredibly valuable because they
Speaker 3: can be used to leverage other exploits that can earn
Speaker 3: other people like Kazoo more money. So for those people
Speaker 3: a very uncertain future in an ideal situation, not that
Speaker 3: it is ideal. Perhaps manage my health paid the money.
Speaker 3: Perhaps Kazu did what Kazoo said they would do and
Speaker 3: deleted all the information and that's the end of it.
Speaker 3: But those people that have been affected will not know that,
Speaker 3: and they can never really be sure, and that's a deeply,
Speaker 3: deeply unsettling thing for them.
Speaker 1: Thanks for joining us.
Speaker 4: David, Thank you Chelsea.
Speaker 2: After the breach, Adam Burns of security company black Veil
Speaker 2: voluntarily tested the website and app and found flaws in both.
Speaker 2: He joins US now to break down what happened and
Speaker 2: what companies can do better to protect themselves.
Speaker 1: And you, So.
Speaker 2: Adam, were there any warning signs or security gaps from
Speaker 2: your point of view when it comes to manage my health?
Speaker 6: From the research that I did and posted in the blog, Yes,
Speaker 6: there were some big gaps that should have been plugged
Speaker 6: a long time ago. These are basic fundamental DNS domain issues.
Speaker 6: So yeah, there was a number of gaps that I
Speaker 6: would consider them to be required for any organization, but
Speaker 6: especially a health organization dealing with patient records and such.
Speaker 1: And what kind of gaps? So you mentioned DNS.
Speaker 6: Yeah, DNS stands for Domain Name system, So I'll just
Speaker 6: explain real quick what that is. When you visit a
Speaker 6: website on the Internet, you type a name like inzidherold
Speaker 6: dot cot inz DNS. Server takes that name and converts
Speaker 6: it into an IP address, so that's where the server
Speaker 6: actually is. And yeah, DNS essentially without DNS, the Internet
Speaker 6: does not work, so you can see how important it is.
Speaker 6: And DNS also controls where how traffic is directed to
Speaker 6: your website, how emails get to you, how users log in,
Speaker 6: log out, all of those sorts of things. So the
Speaker 6: gaps that I found are talking about email mostly email
Speaker 6: security issues, and domain and website security issues, so pretty
Speaker 6: key things to plug when you've got users logging into
Speaker 6: a health portal.
Speaker 1: Yeah.
Speaker 2: And is that quite a common mistake or gap, I
Speaker 2: suppose for websites in New Zealand.
Speaker 6: Yeah, so I've done I did a lot of research
Speaker 6: on this last year. I built a little app and
Speaker 6: stuck it on the dot nz tldtld sands for top
Speaker 6: level domain. I ran it for about six weeks, collected
Speaker 6: only maybe two and a half thousand domains worth of information,
Speaker 6: but over half of those domains had these exact problems,
Speaker 6: so it's not it's not an uncommon issue. That is
Speaker 6: super common, and it is not just a New Zealand
Speaker 6: problem either. I've extended my research beyond that too.
Speaker 4: Well.
Speaker 6: I've actually covered fifty one countries now with the agent
Speaker 6: that I built. So yeah, it's a global problem. Have
Speaker 6: you heard Instagram got hacked today or yesterday? N No, Okay,
Speaker 6: Instagram was hacked and seven I think it was seven
Speaker 6: million user accounts were leaked onto the Internet like not
Speaker 6: the dark web, they were just leaked onto a forum.
Speaker 7: So I actually scanned them.
Speaker 6: I did the exact same scan on Instagram that I
Speaker 6: did on Manage my Health. Yeah, similar stories Instagram with
Speaker 6: billions of users.
Speaker 2: Similar story and same security gaps.
Speaker 4: Yeah.
Speaker 6: These these problems extend beyond small business into the five
Speaker 6: hundred you know, fortune five hundred realm.
Speaker 2: Yeah. Yeah, and so how can companies kind of rectify
Speaker 2: or you know, do better in that respect?
Speaker 6: The first thing I would be doing is asking your
Speaker 6: I provider, what what are my current security gaps and
Speaker 6: how can we best plug those. I have done my
Speaker 6: best to make that information as accessible as I can
Speaker 6: to people on my website, so people can go and
Speaker 6: scan their domains if they want to, and it will
Speaker 6: actually tell them exactly what I found would manage my health,
Speaker 6: the gaps, how to fix them, and the impact of
Speaker 6: not fixing them, like what is the what is the
Speaker 6: main reason I should fix this? Plot this whole The
Speaker 6: scanner and the results will actually tell you that. And
Speaker 6: if you still still need more help, I'm here, or
Speaker 6: you can speak to the agent buck on our website
Speaker 6: that also provides human that humanizes cybersecurity and technical speak
Speaker 6: in terms of.
Speaker 2: What happened with manage my health and the kind of
Speaker 2: glaringly obvious it seems gaps in many websites in New
Speaker 2: Zealand's security systems. Do you think that hackers worldwide who
Speaker 2: do do this for monetary gain is are looking at
Speaker 2: New Zealand at the minute being like, well there's your
Speaker 2: cash grab.
Speaker 4: Yeah.
Speaker 6: I mean this time of year, New Zealand becomes a
Speaker 6: target just because of the great key we shut down.
Speaker 6: So I don't think we are much of a target
Speaker 6: until this time of year, and I've actually got data
Speaker 6: to prove that. So yeah, we're definitely. The attacks on
Speaker 6: New Zealand and Australia ramp up from November to January,
Speaker 6: and now with this news breaking, I would say will
Speaker 6: be even more of a target.
Speaker 2: Now, how do you make sure if you do have
Speaker 2: your own personal information on the internet with a website,
Speaker 2: are there any ways to make sure that your information
Speaker 2: is actually safe?
Speaker 6: The best thing that you can do to protect yourself
Speaker 6: is make sure that you've got multi factor authentication on everything,
Speaker 6: So enter a password, then.
Speaker 7: It we'll ask you for a code as well.
Speaker 6: Without the code, obviously a hacker can't get into your account.
Speaker 6: They need the physical device that sends you those codes.
Speaker 6: So that is a good way to protect yourself. Other
Speaker 6: than that, you're at the mercy of the people's platform
Speaker 6: that you're using. So the best thing to do there
Speaker 6: is actually ask them, what are you doing to protect
Speaker 6: my information? What controls and regulations have you got in
Speaker 6: place that protect us? And what happens if there's a breach?
Speaker 6: How do you notify as how quickly can you clean
Speaker 6: it up? All those sorts of things are things that
Speaker 6: people really be thinking about when using such critical platforms
Speaker 6: or any platform that you log into.
Speaker 2: In terms of this breach, I'm wondering because obviously we
Speaker 2: hear about breaches every now and again, you know, whether
Speaker 2: it's a banking app or a government app or something
Speaker 2: like that. Those are the ones that we hear about.
Speaker 2: Are those just the tip of the iceberg?
Speaker 6: Yes, that is definitely just the tip of the iceberg.
Speaker 6: A lot of it goes unreported. Some of them are
Speaker 6: so small they're not worth mentioning in the news. But
Speaker 6: a small hack too the news might still be a
Speaker 6: big hack to a small business, for example. So yeah,
Speaker 6: there's plenty of hacks that we are not told about. Yeah,
Speaker 6: it's the wild West. The Internet was built, you know,
Speaker 6: in the nineties on trust and if you look at
Speaker 6: the Internet now, it's no longer a trustworthy place.
Speaker 7: So yeah, it's best to assume.
Speaker 6: That your data is not safe and make sure that
Speaker 6: it is, especially with the intro action of AI. You know,
Speaker 6: if you think about the infrastructure that AI is currently
Speaker 6: running on was built thirty years ago, it's like trying
Speaker 6: to race a Ferrari around a go kart track.
Speaker 7: That's how I would describe it. So yeah, I.
Speaker 6: Almost feel like we need an Internet two point zero.
Speaker 6: But making that happen is virtually impossible or a very
Speaker 6: very slow process because you'd have to do it. Yeah,
Speaker 6: I don't even know how you would achieve that. It
Speaker 6: would be very difficult.
Speaker 7: It's not impossible, but it would be very slow and
Speaker 7: very difficult.
Speaker 2: Well, it seems like the horses bolted and in a lot
Speaker 2: of ways. Hey, I mean, I can imagine. You know,
Speaker 2: back in the nineties, what we would refer to as
Speaker 2: hackers were individuals going in and doing it one by one,
Speaker 2: whereas now they can make quite sophisticated systems that do like,
Speaker 2: you know, a thousand things at once or something.
Speaker 1: That's probably an understatement.
Speaker 6: Yeah, I mean, even just in the last twelve months,
Speaker 6: hacking has become a thousand times easier for people. If
Speaker 6: you think about how easy it is for someone to
Speaker 6: install chat GPT and fill out an essay, for example,
Speaker 6: you can do the same with hacking. There's apps exactly
Speaker 6: like chat GPT for launching spoofing and phishing campaigns. So
Speaker 6: what they actually can do is like a full reconnaissance
Speaker 6: mission on a business, so they can figure out who's
Speaker 6: the CFO, who's the CEO, who's the CTO. Have they
Speaker 6: been mentioned in the news recently, what time of year
Speaker 6: is it? Have they mentioned the going up a seat,
Speaker 6: those sorts of things. They do a full recon and
Speaker 6: it's fully automated now, so it takes a lot of
Speaker 6: that manual effort away from the hackers. A lot of
Speaker 6: it used to be manual. Now it's all automated.
Speaker 1: So where do we go to next.
Speaker 2: Is it just safe to have none of your personal
Speaker 2: information on the Internet or is that completely unavoidable.
Speaker 6: It's pretty much unavoidable, right. We kind of reliant on
Speaker 6: technology and the internet without you. Imagine if the Internet
Speaker 6: was off for a day, the world would stop. So
Speaker 6: it's not like you can't stop using it. You have
Speaker 6: to keep using it. You just have to be super
Speaker 6: vigilant with protecting your credentials, be very very aware of
Speaker 6: the platforms that you're actually using. Maybe even see if
Speaker 6: as more secure alternatives. And yeah, just be very very
Speaker 6: suspicious of any links and emails. Like the best advice
Speaker 6: I can offer you for links and emails is hover
Speaker 6: over it. If the link you hover over doesn't look right,
Speaker 6: don't click on it.
Speaker 1: Thanks for joining us, Adam no worries.
Speaker 2: That set for this episode of the Front Page. You
Speaker 2: can read more about today's stories and extensive news coverage
Speaker 2: at nzadherld dot co dot nz. The Front Page is
Speaker 2: produced by Jane Ye.
Speaker 1: And Richard Martin, who is also our editor. I'm Chelsea Daniels.
Speaker 2: Subscribe to the front page on iHeartRadio or wherever you get.
Speaker 1: Your podcasts, and tune in tomorrow for another look behind
Speaker 1: the headlines.