By Katalina Siasau
Confidential information from Tonga’s health system has been copied and leaked by cyber criminals who have encrypted the National Health System and are demanding a USD$1 million ransom, which the government refused to pay.
The Minister for Health, Hon. Dr ‘Ana ‘Akau’ola, said yesterday that four sample files have been released on the dark web by the cyber criminals. These samples include general and public information, and one case concerning a patient.
The cyber criminals published a small sample of potentially exfiltrated information on the internet on 27 June.
"If this sensitive information reaches you, please do not send it around," she said.
The minister urged the public not to use this information to harm or shame patients.
While some leaked information may not pose a direct threat, “health records contain confidential details that should only be shared between nurses, doctors, and relevant personnel involved in patient care,” she told a media briefing on 30 June, at the Ministry of Health, Tofoa.
“I hope that this malicious act would not be used against vulnerable individuals by circulating confidential information, because you would be no different from the criminals who attacked the system.”
Every person admitted to the hospital is registered. There are thousands of patient files in the hacked system. “We see over a hundred people daily, with numbers exceeding 200 during outbreaks, totalling just under a thousand weekly, including repeat patients.
“There is a possibility of more patient-related data being leaked,” she said.
Recovery effort
Australia’s Cyber RAPID team who are supporting CERT Tonga, have advised that similar situations are occurring with increased frequency across other Pacific health networks.
The cyber experts are working to recover the Ministry of Health Information system have not yet identified whether the hackers are local or international.
Cyber criminals seized control of the National Health Information System on 15 June, and since then doctors and hospitals have reverted to paper record keeping.
“Information held in some of those systems was copied by the criminals. This has not affected the ability for residents to access Healthcare services. No information was deleted or changed as part of this attack,” the Ministry stated.
