As well as bringing in outside cyber security experts, the National Cyber Security Centre was also guiding his team in how to deal with those claiming to be the hackers, Snee said.
"We've had a communication, but whether that is from the ... malicious actors or whether it is somebody else - we have to check the veracity of that," he said.
Health officials also confirmed Tuesday's attack didn't appear to be linked to a major ransomware assault on Ireland's health network recently.
It came as high-profile cyber attacks had increasingly made headlines around the world, including the Irish attack last Friday and another that shut down an important United States' fuel pipeline this week.
The Ministry of Health said it had encouraged DHBs and their staff to have plans ready to deal with cyber incidents and be vigilant using the internet careful.
"All DHBS face cyber attacks in various forms daily," a Ministry of Health spokeswoman said.
"For security reasons, we will not be commenting on the response to the Waikato DHB incident in greater detail at this time."
Waikato DHB's Snee said the cyber breach occurred at 2.40am
One of the leads investigators were following was that it entered the health provider's network through an email attachment.
"That is one working assumption, but we're not certain at this stage," he said.
The attack quickly threw Waikato health services into disarray as surgeries were postponed and it became hard to access patient records and test results.
However, Snee said hospitals had made progress getting surgeries back on track.
That included 95 out of 101 surgeries being completed yesterday and 72 out of 102 being completed today.
"All the acute surgery is going ahead mostly down here, but occasionally things will need to be transferred to partner DHBs," Snee said.
While cancer patients were being given priority, radiotherapy treatments were also disrupted, with test results and some patients being sent to Auckland.
"Our radiotherapy work has been disrupted because that is very dependent on computer systems and we have sought help from Auckland," Snee said.
An Auckland DHB spokeswoman said they were "liaising with Waikato DHB regarding the possible transfer of a relatively small number of patients".
Snee said he couldn't yet comment on the nature of the cyber attack, including whether the hackers had left hidden code inside the DHB's network and whether files remained locked or encrypted.
He also said investigators believed the risk of losing patient data was low.
"But we can't be certain at this stage, so it remains a risk," he said.
Outpatient services - where patients sought treatment at the hospital but didn't stay overnight - was the most disrupted, partly due to problems scheduling and conducting tests.
However, Snee hoped outpatient services would pick up in the next few days as staff relied on more low-tech solutions, such as pen and paper and dedicated laptops that weren't part of the network but had access to patient records.
