Hacker marks living patients as dead in New Zealand hospital cyberattack

The New Zealand medical app MediMap was thrown into chaos after an acute hack left it in disarray, severely affecting one elderly care home in particular, and even branding some of the victims as "Charlie Kirk."

Some of the patients began disappearing in real time, while others were marked as having passed away. Most outrageously of all, however, was that the hackers had the audacity to change some of the patient names to “Charlie Kirk,” the firebrand conservative who was assassinated in the US last September.

“We just kept losing more patients from the screen,” a registered nurse told Stuff Digital, describing how records were suddenly altered, with around a third of users having their records altered during the incident.

The panic the hack caused rippled through the home, throwing routine practices off course.

We just kept losing more patients from the screen. And so I started panicking because it was nearly tea time and medications were not going to be given,

revealed the nurse.

This was when she noticed the immensity of the situation.

The facility was forced to revert to paper-based medication charting, which had a knock-on effect.

Staff reported that MediMap required both a company login and a personal login, but did not use two-factor authentication.

Hacktivist tactics

MediMap confirmed “unauthorized activity” that resulted in patients’ demographic records being “incorrectly modified.”

According to the company, the affected data includes names, dates of birth, assigned prescribers, locations of care, and resident status, with some patients even being assigned to different facilities.

The damage caused by the hack stretches beyond the destabilizing of one care home, however. MediMap is a widely used app in New Zealand, with around 60% of aged care facilities in the country depending on its infrastructure.

The hack could affect more than 2,000 GPs, 340 facilities, and 350 pharmacies, and potentially reach into the tens of thousands of patients, according to Stuff Digital.

And the use of a politically charged name such as Charlie Kirk’s could be intended as a case of hacktivism, a brazen branding of political ideals, rather than a standard data breach.

Unlock more exclusive Cybernews content on YouTube.