ManageMyHealth Data Breach Exposes 120,000 Patients’ Records in New Zealand

A major cybersecurity breach of New Zealand’s largest private patient portal, ManageMyHealth, has exposed sensitive medical information belonging to over 120,000 patients, prompting urgent legal action, government reviews, and widespread concern across the healthcare sector.

‍

The breach, disclosed in late December 2025, involved unauthorized access to a document storage module of the platform and the exfiltration of more than 400,000 medical documents, including referrals, discharge summaries, lab results, imaging reports, and correspondence uploaded by patients or clinicians.

Platform Background

ManageMyHealth is a privately operated online portal used by general practices nationwide. It allows patients to access health records, book appointments, request prescriptions, and communicate with healthcare providers. With approximately 1.8 million registered users as of 2025, it is New Zealand’s largest patient-facing health information system and operates independently of Health New Zealand (Te Whatu Ora).

‍

The service is widely used across the country, including 45 practices in the Northland Region and 355 other “referral-originating” medical practices.

‍

The company became aware of unauthorized access on 30 December 2025 after notification by a partner organization. Immediate actions included securing systems, preserving evidence, engaging cybersecurity specialists, and notifying authorities, including New Zealand Police, the Privacy Commissioner, and Health New Zealand.

‍

A public holding statement acknowledging a cybersecurity incident was posted on 1 January 2026. Investigations remain ongoing, with further updates expected as facts are verified.

Scope of the Breach

The breach was limited to a document storage module and did not affect core patient databases or national clinical systems. ManageMyHealth stated that there is no evidence that usernames, passwords, or sensitive system functionality were compromised.

‍

However, media reports indicate the stolen documents date back several years, including material from 2017 to 2019, and some relate to patients whose practices no longer use the platform.

‍

A group identifying itself as “Kazu” claimed responsibility for the attack, demanding a US$60,000 ransom and threatening to publicly release the data. Samples of stolen documents were published online to substantiate the claim. ManageMyHealth declined to comment publicly on the ransom, citing ongoing police investigations and legal proceedings.

‍

On 5 January 2026, ManageMyHealth obtained an urgent High Court injunction to prevent publication, dissemination, or use of the stolen data. The court ordered that anyone in possession of the stolen documents must delete them, citing the highly sensitive nature of the information.

‍

Online posts associated with the attackers referencing the stolen data were subsequently removed.

Patient Impact

The breach has raised concerns over identity theft, extortion, blackmail, phishing, and impersonation scams. Patients and general practices reported confusion and difficulty accessing information, with many learning of the breach through news coverage rather than direct communication from the company.

‍

Advocacy groups emphasized the particularly sensitive nature of the data, which may include records relating to sexual violence, family harm, and other highly personal information.

‍

ManageMyHealth has begun notifying affected practices and patients via email, in line with the Privacy Act 2020. A dedicated helpline was established to provide guidance and support. The company aims to complete notifications by mid-January 2026.

Criticism of Company Response

The handling of the breach drew nationwide criticism. Concerns included delays and inconsistent communication, technical issues with portal access, and frustration among healthcare providers over incremental disclosure of affected patient information.

CEO Vino Ramayah faced scrutiny for comments suggesting the attackers gained access “through the front door” using valid credentials, which critics said downplayed the company’s responsibility. Ramayah did not disclose whether ransom negotiations were considered, citing police involvement.

‍

Health New Zealand confirmed that its systems and national databases were unaffected. On 5 January 2026, Minister of Health Simeon Brown commissioned an urgent review of both ManageMyHealth and the broader response by Health New Zealand.

The Public Service Association highlighted the incident as an example of risks stemming from reduced investment in digital and IT capabilities in the health sector.

‍

Cybersecurity experts and commentators have compared the breach to previous high-profile attacks, including the 2021 Waikato District Health Board ransomware incident, underscoring ongoing vulnerabilities in healthcare data protection.