Cyber Incident Victim: Kuripuni Medical Centre
Date:
Aug 2019
Location:
New Zealand
Summary
A cyber attack targeting a Tu Ora Compass Health server disrupted access to websites for four medical centers, including Kuripuni Medical Centre, forcing their temporary takedown. The attacker, identified as "VandaTheGod," initially justified the incident as a protest action but later denied intentionally targeting medical facilities, claiming their focus was government and education domains while speculating potential .edu affiliations. The perpetrator offered no further clarification after being challenged about the risks to healthcare services.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On August 17, 2019, a cyber security attack impacted four medical centers in Wairarapa, New Zealand—Kuripuni, Greytown, Featherston, and Carterton—alongside their parent organization Tu Ora Compass Health. The attack forced all entities to take their public-facing websites offline, rendering them inaccessible to patients and the public. The incident originated from a compromise of Tu Ora Compass Health’s server infrastructure, which hosted the affected medical centers’ websites. This disruption occurred within the context of a broader global cyber attack campaign, though specific technical details about the attack vector or malware used were not disclosed in available reports. The immediate operational response involved isolating the compromised server and deactivating the dependent websites to contain the threat, though restoration timelines remained unclear at the time of reporting.
A Twitter user using the handle “VandaTheGod” claimed responsibility for related cyber attacks, initially framing their actions as a form of protest. When directly questioned via direct message about targeting medical centers, VandaTheGod responded with fragmented English stating, “Protest, my brother. Its spam my mensage.” After reviewing a news link about the medical center disruptions, the individual denied intentionally attacking healthcare entities, asserting, “Im no remember hack site medical. My atack gov edu.” DataBreaches.net suggested medical facilities might have been incidentally compromised due to potential .edu domain affiliations with academic institutions, though no confirmation of such linkages was provided. The attacker offered no further justification or acknowledgment after this exchange. The incident highlighted operational risks to healthcare providers during indiscriminate cyber campaigns, with no additional mitigation steps or long-term consequences disclosed in the source material.