Fisher & Paykel Healthcare Reports Cyber Breach

Fisher & Paykel Healthcare, the New Zealand maker of breathing and sleep-apnoea devices, says an intruder got into two employee email accounts and a subset of company files, some of which held personal information.

The company disclosed the incident in a statement to the NZX on Thursday morning, New Zealand time. It said it had been made aware of “unauthorised and unlawful access to two employee email accounts and a subset of company files”, and that it “immediately activated its response protocols to contain the incident and investigate the nature and extent of the activity”.

TSN tracks attacks like this on its ransomware and cyber attacks hub.

Patient-data systems were not hit, the company says

The firm’s central reassurance concerns patients. “There is no evidence that the unlawful activity compromised the company’s system that maintains patient data,” it said. It added that its products, manufacturing operations and supply chain were unaffected, and that it could still supply and support customers and patients without interruption.

Some people’s data was exposed, however. Some of the files accessed contained personally identifiable information, and the company says it is notifying those affected and has told the relevant authorities. It has not said how many people are involved, what kind of information the files held, or which authorities it informed.

Email accounts are a common way in for attackers and a common target in their own right, because they often hold attachments, contact lists and conversations that are not stored anywhere else. The statement does not say how the two accounts were accessed or whether the intruder used them to reach the files.

No ransomware found and no financial hit expected

Fisher & Paykel says it has “identified no evidence of ransomware or malware, believes the incident has been contained and does not expect any material impact on its financials or operations”. That would put the episode at the smaller end of corporate breaches, without the encrypted systems or halted production that come with a ransomware attack. It is the company’s own early assessment, and investigations of this kind often change as they go on.

The company also gave no timeline. Its statement does not say when the access took place or when it was discovered.

Shares slipped during the session

Reuters, reported by CNA, said Fisher & Paykel’s shares fell as much as 1.5% to NZ$48.68 during Thursday’s session. The company is listed in both New Zealand and Australia.

Fisher & Paykel designs and makes products for acute and chronic respiratory care, surgery and the treatment of obstructive sleep apnoea, and says it sells them in more than 120 countries. Its statement was authorised by its chief executive.

For the people whose details sat in those files, the next step is the company’s notification letter, which should say what was taken.