Fisher & Paykel Healthcare Hit by Cyber Breach, Says Employee Emails and Files Were Accessed

By Hamza Faisal

New Zealand medical device maker Fisher & Paykel Healthcare has disclosed a cyber breach after discovering that an intruder gained unauthorized and unlawful access to a subset of company files and two employee email accounts.

The company said Thursday that some of the files accessed contained personally identifiable information, and that it is in the process of informing the people affected. It has also notified the relevant authorities.

Patient data systems not compromised

The company moved quickly to reassure customers. "There is no evidence that the unlawful activity compromised the company's system that maintains patient data," it said, adding that there has been no impact on its products, manufacturing operations or supply chain.

Fisher & Paykel is one of the world's largest makers of devices used to treat obstructive sleep apnea and provide respiratory care — products hospitals and clinics depend on every day. For a healthcare manufacturer, a breach that reaches into systems holding patient information would be far more serious, which is why the company stressed that those systems remain untouched.

Contained, no ransomware found

The company says it believes the incident is contained, with no evidence of ransomware or malware identified in its systems. It also said it expects no material financial impact from the breach.

That assessment matters to investors: shares of the company still fell as much as 1.5 percent to NZ$48.68 during Thursday's session, a reminder that even "contained" breaches shake confidence in listed companies.

The company has not said how the attacker got in or when the access began — details that typically emerge only after forensic work is complete. Email accounts are a common entry point in corporate intrusions: a compromised inbox can unlock password resets and deeper access across internal systems.

One more cyber headline in a rough week

The disclosure lands a day after government websites in Europe and elsewhere went offline, when the disclosure of critical flaws in a widely used programming language sent site operators worldwide scrambling to protect their systems.

Medical and healthcare organizations remain among the most frequently targeted sectors. A US sleep-apnea device maker and a corporate advisory firm were both named on ransomware leak sites within the last 48 hours — underscoring that the sector faces attacks from both data-theft intruders and extortion gangs at the same time.

For Fisher & Paykel, the test now is transparency: how much detail it shares with affected individuals and regulators in the coming days will decide whether Thursday's disclosure calms the story or fuels it.

By Hamza Faisal