It is very important that everyone reads this information AND acts on it

You will be aware the New Zealand Stock Exchange (NZX) has experienced multiple Distributed Denial of Service (DDOS) attacks this week.

The responsible approach is to assume there is a heightened risk that other sectors could also be the target of a DDOS attack, this includes the New Zealand health and disability sector.

If you are a provider of health and disability services (some of whom are NZHIT members) then you must discuss this situation with your IT provider (many of whom are NZHIT members) and be guided by their advice.

If you are a IT provider then you must ensure your customers are fully aware of the seriousness of this situation and provide up-to-date and trusted advice on how they are to protect themselves from an attack.

A DDOS attack is where hackers effectively flood web services with network traffic so the website or service cannot be accessed or crashes. Hackers also typically include a ransom demand that, if not paid, they will continue to flood the organisation.

This type of cyber-attack is not new and isn't particularly sophisticated but it is also a timely and important reminder of the basic security measures that we all should have in place when implementing internet facing services.

Advice and Guidance:

To avoid a possible DDOS attack everyone is advised to:

1) Check with your internet provider that your external services / websites have DDOS protection.  If they don't then inquire how you can purchase these services or implement suitable protection. 

2) Check that external services and networks flow through your DDOS protection services.  Often attackers will target services you did not know were missing protection so take some time to check for any gaps.   

3) Have practiced what you would do in an incident, including who would be your incident response partner i.e. have a business continuity plan and make sure it works.

The National Cyber Security Centre (NCSC) has useful guidance and advice about the management of incident response available here.

Additional guidance is also available from CERTNZ and the Australian Cyber Security Centre

Feel free to contact Scott Arrol, CEO NZHIT if you have any queries relating to this matter - +64 21 414631 or