New Zealand medical-device maker Fisher & Paykel Healthcare has disclosed a cybersecurity incident involving unauthorised access to two employee email accounts and a limited set of company files.
The company said some of the accessed files contained personally identifiable information and that it is notifying people whose data may have been affected.
However, Fisher & Paykel Healthcare said there is currently no evidence that the attackers compromised the system used to maintain patient data.
Its products, manufacturing operations and supply chain also continued operating normally.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Two Employee Email Accounts Were Accessed
The company said it became aware of unauthorised and unlawful access to two employee email accounts and a subset of internal files.
It activated its incident-response procedures and began investigating the nature and extent of the intrusion.
Fisher & Paykel has not publicly disclosed when the attackers first gained access, how the accounts were compromised or exactly what types of files were accessed.
It has, however, confirmed that some documents contained personally identifiable information.
That can include information capable of identifying an individual, such as a name, contact information or other personal details.
The company has not publicly disclosed how many people are affected or exactly what information was exposed.
It said affected individuals are being notified and that relevant authorities have also been informed.
Patient Data System and Manufacturing Unaffected
One of the most important parts of the company’s disclosure concerns patient information.
Fisher & Paykel said it has found no evidence that the system maintaining patient data was compromised.
That distinction matters because the company develops medical devices used in respiratory care, surgery and treatment of obstructive sleep apnoea.
Its products are used in hospitals and healthcare settings around the world.
The company also said there had been no impact on its products, manufacturing facilities or supply chain.
Customers and patients can therefore continue receiving products and support without interruption, according to the company.
Fisher & Paykel sells medical products in more than 120 countries.
A disruption to manufacturing or distribution at a company of that scale could have wider implications for hospitals and healthcare providers.
So far, there is no evidence that this incident reached those operational systems.
No Ransomware or Malware Found
Fisher & Paykel said investigators have identified no evidence of ransomware or malware.
Ransomware is malicious software that encrypts systems or steals information before criminals demand payment.
But not every data breach involves ransomware.
Attackers can also gain access through compromised employee accounts, stolen credentials, phishing or other techniques without installing malicious software.
The fact that two email accounts were accessed raises questions about whether stolen credentials or account-based intrusion may have played a role.
The company has not identified the attack method publicly.
It said it believes the incident has now been contained.
Fisher & Paykel also does not expect the breach to have a material effect on its financial performance or business operations.
That assessment could still change if investigators discover additional exposure, but the company’s current position is that the incident is limited.
Healthcare Companies Remain High-Value Cyber Targets
The incident comes amid increasing cyber pressure on healthcare companies and medical-device manufacturers.
Healthcare organisations hold valuable combinations of identity, financial and medical information.
That makes them attractive targets for both cybercriminals and extortion groups.
The risk is not limited to stolen records.
Medical manufacturers increasingly rely on interconnected systems for research, manufacturing, remote monitoring, distribution and customer support.
A cyberattack that reaches those systems can potentially disrupt real-world medical services.
Recent incidents involving other medical-device companies have shown how attacks on supporting IT infrastructure can affect operations even when medical devices themselves are not directly hacked.
Fisher & Paykel’s disclosure therefore makes an important distinction between personal information held in ordinary company files and the separate system used to maintain patient information.
The investigation is continuing, and the company has not yet disclosed the identity of the attackers or whether any stolen information has appeared online.
Further notification obligations may depend on what investigators determine was accessed and which jurisdictions the affected individuals are located in.
What this means for you:
If you receive a breach notification from Fisher & Paykel Healthcare, verify it through official company channels before responding. Be cautious of follow-up phishing emails or calls that may exploit news of the incident to request passwords, financial details or other personal information.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
