We must acknowledge the risk of having all our personal data online – Editorial
We live much of our lives online now and this week we were yet again reminded of how vulnerable some of our personal information is.
A cyber security breach late last month of ManageMyHealth may have compromised the personal health information of about 126,000 New Zealanders.
ManageMyHealth is a portal some general practices use to communicate with their patients. Health Minister Simeon Brown said Health NZ was working with the private operator on a “rapid notification” plan to let those affected by the breach know what information of theirs might be in the public domain.
ManageMyHealth, meanwhile, has also applied to the courts for an injunction to try to prevent people from republishing any information released by the attackers.
In a digital age, however, this seems like a completely analogue response. A New Zealand court order has little power in a world that is without borders or any real regulation.
At this stage, we don’t know who the hackers are, but Brown has told us they have asked for a ransom and are exploiting people’s personal information for their financial gain.
The Government’s general position, Brown said, was not to pay such actors. There’s no guarantee the attackers, who are increasingly sharpening their tools with AI, would keep their word.
And it is here which lies the problem with storing some of our most personal and valuable information online.
If our data is leaked or hacked from the company responsible for storing it, we have lost complete control.
There are now multiple examples of personal data finding its way into the wrong hands, some involving the biggest companies. Last year, it was reported that an estimated 16 billion Apple, Google, Facebook and other passwords may have been exposed in what was likely to be the biggest hack data leak ever.
Brown has asked the Ministry of Health to start a review of the ManageMyHealth incident before the end of the month.
He said the review should assess the cause of the breach, review the adequacy of the data protections that were in place and consider the response to the incident. It should also recommend any improvements required to prevent another breach.
“Patient data is incredibly personal and, whether it is held by a public agency or a private company, it must be protected to the highest of standards,” Brown said.
It will be interesting to see what recommendations such a review will come up with.
What we as users should do in the meantime is use this latest example as an opportunity to review what information we have upload online.
There are helpful tools, such as the Government’s ‘own your online’ risk assessment, while Netsafe also provides useful advice to better protect your data.
In some cases, particularly with companies outside of New Zealand’s legal jurisdiction, people may want to ask themselves if the short-term convenience is worth the risk of relinquishing control of your personal information.