Tonga

Situation Summary

Tonga faces a contained but significant cyber-security incident rather than a broad security crisis. A ransomware attack on the Ministry of Health, claimed by the INC Ransom group, has disrupted the National Health Information System and exfiltrated sensitive health and personal data, but hospitals remain operational under manual procedures and the government has committed publicly not to pay the US$1 million ransom. The global threat environment shows elevated activity in the Middle East and US policy spheres, but Tonga itself remains at low composite risk (#193 globally, 2.1/10) with no tracked security events on the island. Travel and general safety conditions remain normal; the immediate risk to corporate operations and expatriate personnel is cyber-sector focused rather than physical or civil-order based.

Key Developments

• Nukuʻalofa, Tongatapu – Ministry of Health ransomware attack ongoing. The National Health Information System remains fully encrypted; public-facing website is down. INC Ransom has claimed responsibility and published sample exfiltrated documents (communicable disease report, COVID-19 summary, visa letters, ICU flow chart), confirming data exfiltration. Australian cyber experts are assisting remediation.[1][2]

• National – government anti-ransom stance established. Tonga's Minister for Police and Cyber Security has publicly reaffirmed the government will not pay the ransom, signalling official policy and an active joint cyber-incident response effort with Australian counterparts.[1]

• National – health service continuity degraded but maintained. All health facilities remain operational but are functioning on paper-based records; patients must bring physical clinic cards, creating delays and heightened risk of record-keeping errors and delayed care.[1][2]

• National – pattern of critical-infrastructure targeting. Tonga's state-owned telecom provider was hit by Medusa ransomware in 2023, indicating a sustained and escalating cyber-threat environment targeting government and utilities sectors.[2]

• National – travel and general safety posture stable. Australian Smartraveller advisory remains green ("exercise normal safety precautions"); no alerts for civil unrest, terrorism, or widespread crime; routine risks remain petty crime and natural hazards (cyclones, volcanic activity).[4]

Highest-Risk Areas

Tongatapu (risk 45) dominates the sub-national risk profile and is the primary exposure area for organizations with staff or assets in Tonga, as it contains the capital and all major government and health-sector infrastructure currently affected by the ransomware incident. Vavaʻu (risk 28) and Haʻapai (risk 22) register secondary risk levels but remain peripheral to current cyber incidents; their risk scores likely reflect smaller populations, lower digital infrastructure density, and limited incident history. The cyber-security posture of Tonga's critical infrastructure—particularly health and telecom sectors—appears to be a key driver of Tongatapu's elevated rating and should be monitored as a leading indicator of broader government and essential-services vulnerability.

How GeoBit Would Assist

Security teams can use GeoBit's Intel Sweep and OSINT fusion to track ongoing Ministry of Health incident details, INC Ransom darknet activity, and remediation progress in real time across open sources and monitoring feeds. AOI Monitoring & Early Warning on Tongatapu can alert to new critical-infrastructure incidents or ransomware claims affecting sectors relevant to duty-of-care operations (health, utilities, finance). Network & Actor Analysis can support attribution of the INC Ransom group and prediction of secondary targets within Tonga's government and telecom sectors.

7-Day Outlook

The ransomware incident is expected to remain contained to the health sector in the near term, with manual operations and Australian remediation efforts likely to prevent system-wide infrastructure collapse. No escalation to physical security, civil unrest, or broader ransomware campaigns is forecast. Authorities' public anti-ransom stance reduces incentive for expanded attacks but does not eliminate cyber-sector risk; organizations should monitor for secondary incidents in other government and utilities sectors over the coming week.

Highest-Risk Areas — Ranked