File-borne breach events · Oceania
New Zealand: documented file-borne breach events
New Zealand's largest health-sector cyber attack, the 2021 Waikato District Health Board ransomware incident, was publicly attributed by the board itself to an email attachment as the initial incursion.
Overview
What the record shows
The May 2021 ransomware attack on Waikato District Health Board was described at the time as the biggest cyber attack in New Zealand's history, and it is the country's clearest candidate for a file-borne record. The health board stated publicly that it believed the initial incursion came via an email attachment, and national reporting carried the same account.
The record here is the organisation's own stated assessment rather than a published forensic report, and the board's commissioned independent review was never released. This page reflects exactly that: the vector is presented as the board stated it, and no further.
Documented events
File-borne incidents in New Zealand
Most recent first. Every entry cites the public record it is drawn from.
-
Hutt City Council: A phishing email actioned by staff turned council mailboxes into an attack platform
The March 2026 compromise was disclosed in a council report in April 2026. Five individuals had identity information compromised and 732 people may have had financial information exposed through email correspondence. The council reported the incident to the Office of the Privacy Commissioner and tightened security settings, monitoring and staff training; it declined a public records request for the full incident report.
The documented vector. Phishing email actioned by a staff member, leading to takeover of several mailboxes. The council's incident report, as reported to its audit and risk subcommittee, records that the attack originated from a staff member responding to a phishing email, which gave attackers access to a small number of email accounts. Those accounts were then used to send further malicious email internally and externally.
How this class of vector is removed
The record names phishing as the route but not what the message carried. Inbound mail is processed before it reaches anyone rather than trusted on the strength of its sender, and a carried document is rebuilt to its format's known good specification, which is what this class of vector usually turns on and does not depend on the reader spotting anything. The record does not establish what arrived, so this is held at low confidence. What the council's account does establish is that compromised mailboxes then sent further malicious mail internally, and mail arriving from a genuine internal sender is processed exactly as anything else is, because the control does not consult sender reputation.
Email CDR RelayContent Disarm and ReconstructionGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- government
-
Waikato District Health Board: Hospital network taken down by ransomware the board attributed to an email attachment
On 18 May 2021 ransomware disabled IT systems and phones across Waikato, Thames, Tokoroa, Te Kuiti and Taumarunui hospitals. Surgeries were postponed, radiation therapy was suspended with some cancer patients transferred, and services ran on paper for roughly four weeks. After the government declined to pay, attackers leaked patient, staff and financial data on the dark web on 29 June 2021. Full clinical restoration took until mid June 2021.
The documented vector. Malicious email attachment (file type not published), the board's stated initial incursion. Waikato District Health Board stated publicly that it believed the initial incursion was via an email attachment, and contemporaneous national reporting described the malware as arriving in an email attachment as part of a phishing campaign. The vector stands as the board's own day one assessment: the published incident analysis has its malicious activity sections withheld in full, so the attribution was never independently confirmed on the public record, nor was it retracted.
How this class of vector is removed
The vector as the board stated it, a malicious email attachment, belongs to a class handled on the mail path: an attachment in a supported document format is rebuilt to its known good specification before delivery, independent of any detection verdict on the ransomware family. The board never published the file type, and the incident analysis has its malicious activity sections withheld, so which of those two outcomes would have applied is unknown. The mapping is held at low confidence for that reason.
Content Disarm and ReconstructionEmail CDR RelayGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- healthcare
Scope
How to read this page
Every event on this page meets three tests before it is published. It is documented by reliable public sources: a regulator, an official inquiry, the affected organisation's own disclosure, or reputable press with named confirmation, and each entry links to those sources. The initial access or payload delivery travelled as a file, as the public record states it. And where an entry carries a prevention analysis, that analysis is bounded by what we can evidence; where an entry carries none, that is deliberate.
About the organisations named here. They are named because the public record names them, and for no other reason. Nothing on this page alleges fault, negligence or any breach of duty by any organisation or individual, and nothing here should be read as saying that anyone acted improperly or that their security arrangements were inadequate. Being attacked is not evidence of either, and the organisations on this page include some of the most heavily defended in the region. We summarise what published sources report and link to them so you can read them yourself. We have not independently investigated any incident and we hold no non-public information about any of them. Names are used to identify the organisations concerned; no affiliation with them, and no endorsement by them, is implied, and all trade marks remain their owners'.
About the prevention analysis. Where an entry describes how a class of vector is addressed, that is a general statement about how a control treats that class of content. It is not a claim that our products were in use, that they would have been deployed in that architecture, or that they would have prevented that incident. It is not an assessment of any organisation's actual controls, which we do not know. What a control achieves in practice depends on configuration, deployment and file type. Where an entry carries no prevention analysis, we are making no claim about that event either way.
Generally. This page is a working reference, not an incident report, a security assessment or legal advice, and it is provided without warranty. Details reflect the public record on the review date and may have changed since. If you believe anything here is inaccurate, incomplete or out of date, tell us and we will review it promptly and correct it where the record supports that.
Elsewhere in the region