In May 2021, the Waikato District Health Board was hit by ransomware that took their clinical systems offline for weeks and exposed patient data affecting thousands of New Zealanders. The attack wasn't technically sophisticated — but it was devastating. Here's what happened and what it means for your business.
On 18 May 2021, staff at Waikato DHB arrived to find their computers locked. Screens displayed a ransom demand from a group called "Cuba" ransomware. Clinical systems — patient records, lab results, radiology imaging — were encrypted and unavailable. The DHB had to cancel non-urgent surgeries, divert patients, and revert to paper-based processes across multiple hospitals.
The attack lasted weeks. Patient data — including personal health information for thousands of New Zealanders — was published online when the DHB refused to pay the ransom. The remediation cost was estimated at over $30 million. Several senior IT leaders resigned. A government review followed.
How the Attack Actually Happened
The entry point was a phishing email that delivered a malware payload to one endpoint. The malware — a commodity Trojan called "Dridex" — had been available in criminal markets for years. It wasn't a zero-day exploit or nation-state attack. It was a well-known piece of malware that should have been caught by competent endpoint security.
Once inside the network, the attackers moved laterally for weeks before deploying ransomware — gaining administrative access, identifying backup systems, and positioning themselves to maximise the damage when they finally encrypted everything. The DHB's security monitoring didn't detect this lateral movement. Their backups were connected to the same network and were also encrypted.
The Three Failures That Made It Catastrophic
No endpoint detection: The initial malware wasn't caught because the endpoint security in place was signature-based antivirus — exactly what commodity Trojans are designed to evade. Modern EDR (Endpoint Detection & Response) tools like SentinelOne detect behavioural anomalies — the malware's actions — rather than relying on known signatures. The Waikato attack would likely have been caught at the initial infection stage with modern EDR.
No network segmentation: Once inside one endpoint, the attackers could move freely across the network. Proper network segmentation would have contained the breach to a single segment rather than allowing access to clinical systems, administrative systems, and backup infrastructure simultaneously.
Backups connected to the main network: When ransomware encrypts everything accessible from the compromised network, backups that are reachable from that network get encrypted too. Immutable, offline, or air-gapped backups are the only reliable ransomware recovery mechanism — and the DHB didn't have them.
What This Means for a Small Business
The DHB had a dedicated IT department and still suffered a devastating attack. A small business has fewer resources and less visibility — but the same fundamental vulnerabilities. The difference is that a small business is more likely to simply close after a major ransomware event. The NZ Institute of Directors found that 60% of small businesses that suffer a serious cyber incident close within 12 months.
The protections that would have stopped the Waikato attack are available to small businesses today: behavioural EDR on every endpoint, immutable cloud backups, and monitored network access. Optimyze deploys all three as part of every managed IT engagement.
The Regulatory Consequence
The patient data exposure resulted in Privacy Act obligations to notify affected individuals — thousands of people who received letters telling them their health information had been published online. For a business in a regulated sector, a breach of this scale triggers notification requirements, potential fines, and reputational damage that outlasts the operational recovery.
The Waikato DHB attack wasn't caused by a sophisticated nation-state exploit. It started with one phishing email and succeeded because the fundamental security controls weren't there. Those controls are available to every NZ business — and not having them is a choice with real consequences.
