Computer virus attacks Waikato DHB network

Waikato DHB
Media information
For Immediate Release

17 December 2009

Computer virus attacks Waikato DHB network

A computer virus called Conficker has infected Waikato District Health Board's computer network.

The virus affected the organisation's 3000 computers logged onto its network in Hamilton, Taumarunui, Te Kuiti, Tokoroa and Thames hospitals, as well as its community bases and maternity and continuing care facilities Matariki (Te Awamutu) and Rhoda Read (Morrinsville) and its mental health facilitiy in Hamilton.

As a result of the virus, Waikato hospital laboratory is only able to function at 10 per cent capacity.

Medical staff in Waikato DHB hospitals and doctors in primary care have been asked to limit their requests to urgent ones only because results are usually reported electronically. They've also been told if they have patients waiting for tests in hospital who are clinically stable and fit enough to be at home, to discharge them and arrange admission for next week.

To reduce the load on laboratory staff there is no phlebotomy service for the rest of the week.

The background to the virus is that overnight computer technicians were carrying out a clinical workstation upgrade for the organisation.

At 2am they noticed something going on the network, and suspected a virus. By 4am, the issue was recognised as serious and Microsoft and IT specialists were called in.

It was quickly discovered that the virus was reconstituting itself a lot faster than expected, and was established as the Conficker worm virus.

"This virus is a particularly virulent one," said Waikato DHB spokesperson Mary Anne Gill.

"Everything was shut down immediately and an emergency management team was put in place by 7am.

"Communication at that point was aimed at those staff coming to work for shift handover, and all those hereafter."

The Conficker worm virus infects the host and spawns into two variants, causing havoc to the network, in particular the Microsoft operating system.

It subsequently searches for people's passwords to infect their machines.

"The fist thing technicians did was to tell staff to turn their computers on but lock their workstations using Ctrl+Alt+Del and not log back on," said Ms Gill.

"It is certainly quite a destructive virus.

"If the DHB hadn't spent thousands of dollars over the past three years upgrading its network we might have seen chaos."

She said, as it is, the emergency management team are hopeful of having a solution in place within 24 hours.

"People will be prompted to reset their passwords in a more complex way when they log back onto the network"

Waikato Hospital's Emergency Department and Theatre are operating as usual, and many clinics are still running today, and will continue tomorrow.

Urgent radiology and laboratory testing are unable to be carried out but private providers have made themselves available.

"We are uncertain how the virus got into the network in the first place, however there are three possibilities,"said Ms Gill.

"The first is via an email attachment, the second through one of our own staff using a USB drive while the third is through an external vendor. We have ruled out sabotage.

"We have also disconnected our network from all external connections. We are effectively an island - disconnected from everybody."

About 90 Information Systems staff are working on fixing the problem, and international experts are also involved.

ENDS