Health Board Attacked By Virus

Wednesday, 14 April 2010, 10:24 am
Press Release: Waikato District Health Board

Waikato DHB Conficker Attack Resulted In Global Fix

Two months after the Conficker virus attacked Waikato District Health Board’s computer network, the vendor updated the software in a global fix aimed at ensuring other organisations with similar patches didn’t suffer the same fate.

Two new reports presented to the Waikato DHB board in Thames today (eds 9.30am start) show the Conficker virus was able to get into the DHB’s network on Wednesday 16 December last year because its virus protection software could not eliminate the threat.

(link to the agenda http://www.waikatodhb.govt.nz/index.aspx?pageid=2145849496)

In management comment to an Audit NZ report, chief information officer Alan Grainer said: “the antivirus software did not work.”

Chief executive Craig Climo said weaknesses in the DHB’s own system enabled the virus to spread. Information Technology (IT) staff made the decision to take down the DHB’s 3000 PCs leaving 5800 staff in five hospitals, a mental health facility, two continuing care facilities and a number of rural bases, without computer access.

“We made that decision to protect the system and speed recovery,” said Mr Climo.

“Conficker didn’t get us, we got it.”

Within two days most of the DHB’s computers were up and running.

“We have heard of a major New Zealand site where recovery took five weeks,” he said.

Board members received three reports at the meeting. The first was an independent Audit NZ report with extensive management comment and a memorandum from the Director of Media and Communications over the involvement of the media.

Advertisement - scroll to continue reading

The second was an executive summary of the incident management report done by the IT department.

The third was the executive summary of an October 2009 PriceWaterhouseCoopers report on IT effectiveness.

“Our attack was public because of the way we chose to deal with it,” said Mr Climo.

That involved a number of communication methods including co-operation from the media to convey information to outpatients and staff, mass text messaging and use of runners to relay messages and test results.

“Services operated surprisingly well in that time. The virus, in its various versions, has infected many major sites before and after our attack.”

Estimates suggest close to seven million computers worldwide are infected with Conficker which can now also infect mobile devices like cellphones and medical equipment.

In February this year the Greater Manchester Police computers were crippled by Conficker forcing police officers to depend on computers in other jurisdictions to access criminal records. Affected organisations included the West Middlesex NHS Primary Care Trust and Sheffield Hospital in the UK and in New Zealand the Ministry of Health, Canterbury DHB and a major bank.

Mr Climo told the board broader issues of IT infrastructure soundness are being addressed.

“IT should be more prominent as a risk given our high reliance on it.”

Mr Grainer said USB sticks were still banned from use in Waikato DHB’s network.

“We need to ensure provisions to control risks associated with them are fully worked out and in place before reinstating them,” he said.

The Audit NZ report found that:

• A USB stick carrying the Conficker virus was used by a third party to load files onto their unprotected workstation

• The third party workstation was connected to the DHB network

• The virus entered the network by exploiting a server operating system

• The antivirus software reported the virus but was unable to effectively capture and disable the virus

• Conficker obtained domain administration rights from a logged on user; used those privileges and took hold throughout the server and workstation environment.

ENDS

Waikato District Health Board

Healthy People. Excellent Care

Waikato District Health Board (DHB) employs over 6500 people and plans, funds and provides hospital and health services to more than 391,770 people in a region covering eight per cent of New Zealand.