New Zealand's MediMap hacked to alter patients' demographic records

Digital medication platform MediMap has admitted that malicious actors hacked its platform to change the demographic information of patients located in New Zealand, including listing some living patients as deceased.

 

The hacking occurred on Sunday, February 22, when users of the platform in New Zealand noticed that some patients’ demographic information, including their names and dates of birth, had been altered. Worryingly, some living patients were marked as deceased on the platform, raising serious privacy concerns.

 

MediMap confirmed the hacking on Tuesday, stating in a press release that it detected unauthorised access to portions of its system on Sunday and quickly placed the platform into maintenance mode as a precautionary measure to ensure patient safety. The company also engaged external cyber security experts to safely restore the platform and to provide continued care to patients.

 

"Our preliminary investigation indicates that the incident has affected certain demographic information, such as resident name, date of birth, assigned prescriber, location of care and resident status," MediMap said.

 

"Customers have reverted to their standard alternative manual processes to ensure patients continue to receive the required levels of care they should expect."

 

MediMap is widely used in New Zealand, primarily at aged residential care, disability services, hospices, and community health facilities to streamline prescribing, pharmacy dispensing, and medication administration in care environments. According to public figures, the company provides services to more than 350 pharmacies and more than 2,000 general physicians.

 

"New Zealanders expect that companies involved in healthcare have secure systems and platforms that safeguard their private information. As a private company, MediMap is solely responsible for ensuring the security of its platform," said Health New Zealand’s director of Strategy and Investment, Data and Digital Darren Douglass to RNZ.

 

MediMap said Health New Zealand is in touch with them to learn more about the incident and to provide support, and the incident has also been reported to New Zealand Police and the Office of the Privacy Commissioner.

 

"We understand our platform is critical to aged care and healthcare across New Zealand, and we sincerely apologise for the disruption and concern this situation has caused," the company said. "We are continuing to investigate the impact on patient data while implementing a safe restoration pathway.

 

"We are committed to keeping our all our customers and stakeholders informed as our investigation progresses and will continue to provide updates via our website," it added.