Mercury IT - Accuro Health and others - Cyber Incident

Forums › IT Pro and developers › Mercury IT - Accuro Health and others - Cyber Incident - Dec 22

clinty

1180 posts

Uber Geek

Lifetime subscriber

#302568 2-Dec-2022 15:51

Accuro Heath has reported a Cyber Incident caused by their "External IT Infrastructure Provider being attacked"

https://www.accuro.co.nz/about/news/temporary-outage/

Accuro’s external IT infrastructure provider has been the victim of a cyber-attack that has prevented access to a number of our core systems. Our IT provider is working with their own forensic experts and Government agencies to understand the nature and extent of the impact. We have also notified the relevant regulatory authorities including the Office of the Privacy Commissioner.

At this stage we have no evidence that any Accuro data has been compromised, but we cannot rule out this possibility. Our current focus is working with our IT provider to investigate and understand the situation further. As we know more, we will continue to communicate directly with our members and have set up this information page to provide regular updates. 

For the time being, our systems remain offline which will impact services and we request your patience as we work towards a solution.

Haven't seen any other reports of attacks in NZ - so its a mystery if it is the provider as whole that has been attacked or just Accuro Infrastructure with The External Provider

Clint

Edit added about

1 | 2

1180 posts

Uber Geek

Lifetime subscriber

#3004846 2-Dec-2022 19:04

Media Statement
Accuro Health Insurance has engaged a team of specialist cyber-security advisors after being made aware its external IT infrastructure provider had experienced a cyber-security incident this week.

CEO Lance Walker says that as a result of its IT provider’s incident, Accuro’s day to day operations and customer service have been impacted, however incident response plans have been activated enabling operations to continue via alternative processes.

Accuro’s IT provider has advised relevant Government agencies and engaged specialist cyber security support. Accuro has also notified relevant financial regulatory authorities and have engaged its own advisors.

“We have notified our members, the New Zealand Government’s Computer Emergency Response Team (CERT NZ) and the Office of the Privacy Commissioner.

As a precaution, we are basing our response on the possibility that member data may have been accessed as a result of our IT provider’s cyber-security incident, however this has not yet been confirmed. Our primary focus right now is to fully understand the situation and respond accordingly.

Key services including claims are being maintained, although there will be delays – our priority is making sure we can continue to support our members,” says Mr Walker.

Accuro is a New Zealand-owned operated not for profit health insurance provider supporting more than 34,000 members.

Clint

Starlith

207 posts

Master Geek

Trusted

#3004847 2-Dec-2022 19:07

Not sure which Wellington IT company it is but they have other customers affected aswell.

My partners got an email regarding the exact same detail but for a different organisation.

clinty

1180 posts

Uber Geek

Lifetime subscriber

#3004855 2-Dec-2022 19:45

I found a press release detailing their tie-up with a Wellington company, but decide not to name them as Accuro haven't, and the IT company hasnt posted anything yet so don't want to accusse an innocent party

Sounds like they are still working their way through what the attack may have comprised

Clint

networkn

Networkn
32251 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3004858 2-Dec-2022 20:13

clinty: I found a press release detailing their tie-up with a Wellington company, but decide not to name them as Accuro haven't, and the IT company hasnt posted anything yet so don't want to accusse an innocent party

Sounds like they are still working their way through what the attack may have comprised

Clint

Whomever they are (and I hope no-one here names them as they likely already have their hands full), I wish them Godspeed. I wouldn't wish this on my worst enemy.

michaelmurfy

meow
13217 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#3004911 2-Dec-2022 20:42

I did find out who they are but am not going to name them. The IT providers website is also fully down currently along with a whole lot of other sites they appear to look after.

Seems to be rather serious.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

Lias

5579 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3005715 4-Dec-2022 21:34

Big oof..

I'm a geek, a gamer, a dad, a Quic user, and an IT Professional. I have a full rack home lab, size 15 feet, an epic beard and Asperger's. I'm a bit of a Cypherpunk, who believes information wants to be free and the Net interprets censorship as damage and routes around it. If you use my Quic signup you can also use the code R570394EKGIZ8 for free setup.

PolicyGuy

1716 posts

Uber Geek

ID Verified

Lifetime subscriber

#3006505 6-Dec-2022 17:19

Starlith:

Not sure which Wellington IT company it is but they have other customers affected aswell.

My partners got an email regarding the exact same detail but for a different organisation.

Is this related?

The Ministry of Justice has lost access to some sensitive coronial information due to a cyber attack on an external company.
The ministry said the cyber security incident did not target its systems directly but it was affected through the external company that provided information technology services to a “third party provider” the ministry had contracts with.

https://www.stuff.co.nz/national/130686299/cyber-attack-blocks-ministry-of-justice-access-sensitive-coronial-files

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

Ruphus

464 posts

Ultimate Geek

#3006568 6-Dec-2022 19:09

Looks like it is.

Spreading cyberattacks: Privacy Commissioner opening investigation into Wellington’s Mercury IT as Justice, Health hit - NZ Herald

freitasm

BDFL - Memuneh
79152 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3006577 6-Dec-2022 20:28

Here's the source from the Privacy Commission - in case you can't read the NZ Herald paywalled version:

Privacy Commissioner considers action on ransomware attack

There has been a cyber security incident involving a ransomware attack on Mercury IT. Mercury IT provides a wide range of IT services to customers across New Zealand.

This is an evolving situation. We were notified of the cyber security attack on 30 November 2022. Urgent work is underway to understand the number of organisations affected, the nature of the information involved and the extent to which any information has been copied out of the system. The Office of the Privacy Commissioner is planning on opening a compliance investigation into this incident so that it can make full use of its information gathering powers. We encourage any clients of Mercury IT who have been impacted by this incident and who have not already been in touch with us to contact the Office of the Privacy Commissioner.

Unfortunately cyber security breaches are becoming a regular occurrence. While work is underway to understand and respond to this particular incident we have some key messages for individuals, organisations and members of the public in general.

It is important that people who receive or find information related to this, or any other cyberattack, do the right thing. Do not spread it. Do not share it. Report it to the New Zealand Police. No one should contribute to its widespread dissemination. Spreading this information or profiteering from it causes anxiety and distress to victims.

For individuals - be on the lookout for anything out of the ordinary. Watch out for suspicious texts, emails or unusual things happening with your accounts or records. Be particularly cautious of contact from an unknown source.

If people would like to know more about some steps they could take to protect themselves from privacy breaches they could follow this link: https://privacy.org.nz/resources-2/protecting-yourself-from-a-privacy-breach/

For organisations who hold the personal data of New Zealanders. You have a responsibility under the Privacy Act to take all reasonable steps to ensure that information you hold in trust is safe from cyber-security breaches. This includes where services are contracted from a third party. A failure to take these steps is a breach of the Privacy Act and can result in compliance and enforcement action. This can include the requirement to “put things right” – for the impacted individuals and in terms of information security systems and processes. There is no room for any organisation to be complacent. Trust is hard won and easily lost.

dpf81nz

66 posts

Master Geek

#3006593 6-Dec-2022 21:44

Awesome timing, my family are waiting for 2 payouts on Accuro claims (which were already backlogged i was told) :) Probably wont expect any movement this side of Xmas now. On the flipside, I have a lot of sympathy for the unfortunate IT workers who are dealing with the fallout and recovery

Lias

5579 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3007152 8-Dec-2022 07:21

It's made global InfoSec news.

https://www.securityweek.com/new-zealand-government-hit-ransomware-attack-it-provider

PolicyGuy

1716 posts

Uber Geek

ID Verified

Lifetime subscriber

#3007168 8-Dec-2022 08:18

And in this morning's The CyberWire daily briefing (see https://thecyberwire.com/newsletters/daily-briefing/11/233 )

Third-party incidents in New Zealand and the Netherlands
RNZ reports that New Zealand's Ministry of Justice and Privacy Commissioner are investigating an attack against Mercury IT, a third-party IT services provider, that's affected access to data collected and used by a range of healthcare organizations in that country. Te Whatu Ora (Health New Zealand) has disclosed that "A cyber security incident affecting an IT service provider has impacted access to some Te Whatu Ora data relating to bereavement and cardiac services." The data don't appear, the agency says, to have been compromised, but they have been rendered at least temporarily inaccessible. The Privacy Commissioner became aware of the incident on November 30th, and authorities continue to work on determining the scope of the problem

loceff13

1060 posts

Uber Geek

#3012565 20-Dec-2022 19:47

https://www.nzherald.co.nz/business/24-hour-countdown-ransomware-gang-posts-15m-demand-for-files-stolen-from-provider-to-health-nz-coroners-court-others/HSZ57TXSUFHOHNB7GMB3PNLLCQ/

(premium article, can't read it myself)

10-day countdown: Ransomware gang posts $1.5m demand for files stolen from provider to Health NZ, Coroners Court, others

Lias

5579 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#3012625 21-Dec-2022 06:55

loceff13:

(premium article, can't read it myself)

You may want to google a developer by the name of iamadamdev

clinty

1180 posts

Uber Geek

Lifetime subscriber

#3012639 21-Dec-2022 08:21

loceff13:

https://www.nzherald.co.nz/business/24-hour-countdown-ransomware-gang-posts-15m-demand-for-files-stolen-from-provider-to-health-nz-coroners-court-others/HSZ57TXSUFHOHNB7GMB3PNLLCQ/

(premium article, can't read it myself)

10-day countdown: Ransomware gang posts $1.5m demand for files stolen from provider to Health NZ, Coroners Court, others

Synopsis:

A gang called LockBit has posted a series time-pressure demands for money on the dark web, claiming to have files from clients to Wellington-based IT provider Mercury IT - which was hit by a ransomware attack in late November, according to the Privacy Commissioner.

...

As of 4am this morning NZT (20/12), the gang’s counter had nine days and 20 hours left, according to Brett Callow, threat assessment analyst with Emsisoft - an NZ-based firm helping organisations grapple with ransomware attacks.

...

The gang was also demanding US$999,999 ($1.5m) for files from Mercury IT, US$199,999 for files from Business Central and US$99,999 for files from Accuro.

...

“We are making no comment on the ransom,” Accuro chief executive Lance Walker told the Herald this morning, when asked about LockBit’s US$99,999 demand.

...

Last week a High Court judge issued a blanket order compelling anyone who may have received hacked health data or coronial inquest files - or any client files spilled in the Mercury IT breach - to immediately delete them. The order extended to media.

No other parties are commenting

Clint

1 | 2