Tonga: INC Ransomware group claims responsibility for cyberattack
On 15 June, the INC Ransomware group conducted a cyberattack on Tonga’s National Health Information System (NHIS), resulting in a system shutdown and forcing health facilities to resort to manual operations. Minister for Police, Dr. Paula Piukala, disclosed that the government is unlikely to pay the $1 million ransom demanded by INC Ransomware. INC Ransomware also published four sample NHIS datasets on a darknet website. The government assured the public that their information would not be destroyed, and an Australian cyber team arrived to assist Tongan authorities. Subsequently, the cabinet approved the Personal Health Information and Protection Bill, aimed at protecting the unauthorised disclosure of patients' records. Separately, on June 23, the government, through the Ministry of Police, launched its first National Security Policy (NSP) consultations, which aim to outline national priorities to address environmental degradation, cybercrime, climate change, and economic fragility.
Assessment: The incident is the fourth major cyberattack recorded against a Pacific island country in the first half of 2025.Hacking groups are likely to target the cyber infrastructure of Pacific island countries to exploit vulnerabilities following previous attacks. Pacific island countries are very likely to invest in their cybersecurity infrastructure. Since 2023, INC Ransomware has targeted multiple healthcare facilities in the US, Europe, and Australia using the same extortion tactics. The Tongan government was prompt shifting to manual operations and in seeking the assistance of cyber experts immediately following the attack.
Sources: “Health ministry’s information system hit by ransomware attack,” Talanoa o Tonga, June 19, 2025; Teuila Fuatai, “Tonga cybersecurity attack wake-up call for Pacific, warns expert,” RNZ, July 2, 2025; “INC Ransom group claims responsibility for health system cyberattack,” Talanoa o Tonga, June 29, 2025; “Government face $1 million ransom for cyber attack on health system,” Talanoa o Tonga, June 27, 2025; “Ransomware Spotlight: INC,” Trend Micro, October 29, 2024; “Government launches first National Security Policy consultations,” Talanoa o Tonga, June 24, 2025; “Health data bill to protect hospital patient records,” Talanoa o Tonga, June 28, 2025.
