Fisher & Paykel Healthcare Reports File and Email Breach, Begins Notifications

Fisher & Paykel Healthcare says two employee email accounts and a subset of company files were accessed unlawfully, including files containing personally identifiable information. The New Zealand medical-device maker is notifying affected people and has informed relevant authorities.

In its October 22 statement, the company said it activated incident-response protocols to contain the activity and investigate its scope. It believes the incident has been contained and says it has found no evidence of ransomware or malware.

Patient-data system and production remain separate questions

The company reports no evidence that the system maintaining patient data was compromised. That is a statement about the evidence found so far, not a claim that no personal information was exposed: some accessed company files did contain identifying information.

Fisher & Paykel Healthcare also says its products, manufacturing operations and supply chain have not been affected, and that it can continue supplying and supporting customers and patients. Its business includes respiratory-care devices and products for obstructive sleep apnea.

Notifications proceed while scope is assessed

The statement does not identify an attacker or explain how access was obtained. It also does not specify the number of people whose information appears in the affected files.

Management does not expect a material financial or operational impact. That remains the company’s assessment rather than an independently established final cost. For affected individuals, the notification process and the nature of information involved are more immediate issues than the absence of production disruption.

Sources

• Fisher & Paykel Healthcare statement, reproduced by Sharechat
• Reuters: breach disclosure and company response