Waikato District Health Board ransomware attack

On 18 May 2021, the Waikato District Health Board (DHB) — which ran five hospitals serving more than 400,000 people in New Zealand's central North Island — discovered that its digital systems were failing. Within a day it was confirmed as a ransomware attack, one of the most serious cyber incidents ever to strike New Zealand's public sector.

What happened

The attack, carried out using the Zeppelin ransomware, encrypted servers across the Waikato DHB and took down clinical IT systems and phone lines simultaneously. With patient-record systems, laboratory and radiology results, and internal communications offline, staff were forced into manual, paper-based workarounds to keep caring for patients.

Emsisoft researcher Fabian Wosar described it as the largest Zeppelin breach he had seen. Estimates from security experts put the likely ransom demand in the range of a seven- to eight-figure cryptocurrency sum.

Impact

• All five Waikato hospitals were affected; elective surgeries and some outpatient appointments were postponed, and radiation-therapy treatments were disrupted.
• Phone systems failed, forcing the DHB to publish alternative contact numbers and divert some services.
• On 25 May, attackers claimed to have stolen sensitive patient, staff, and financial data and issued a ransom ultimatum.
• The Waikato DHB and the New Zealand government refused to pay the ransom.
• In early June, a third party released stolen documents on the dark web, confirming that patient and staff information had been exfiltrated.

Recovery

Restoration was slow and laborious. By 2 June, around half of the DHB's servers had been restored; radiation therapy resumed around 7 June; and by 15 June — roughly four weeks after the attack — most clinical services, record access, laboratory diagnostics, and radiology were back online. Even then, staff continued to rely on manual processes in several areas, and the DHB brought in large numbers of additional IT specialists to rebuild systems.

Why it matters

The Waikato DHB attack was a defining moment for New Zealand cybersecurity, exposing how fragile health-sector IT had become and how directly a ransomware event can endanger patient care. It hardened the government's stance against paying ransoms and fed directly into the national reform that consolidated the country's district health boards into a single entity, Te Whatu Ora / Health New Zealand, with cyber-resilience a central concern. It remains the canonical New Zealand example of ransomware as a public-safety, not merely an IT, emergency.