More than 120,000 Kiwis’ health data breached

Thursday, 1 January 2026

More than 120,000 New Zealanders could have their medical information caught up in a Manage My Health breach.

Manage My Health, a privately-owned online portal where patients can communicate with GPs and which holds private personal health data, was on New Year’s Day warning about a “cyber security incident involving unauthorised access to our systems”. It was being investigated and contained.

Manage My Health posted an update on Monday afternoon saying 6 to 7% of its 1.8 million users were affected. That equates to about 126,000 people.

It planned to contact those people within 48 hours from New Year’s Day. The Privacy Commissioner had been notified. It believed the incident had been “contained” but experts were looking at how much data had been “affected”.

Do you know more or are you affected? Email editor@thepost.co.nz

“We recognise that any incident involving health information can cause anxiety and distress,” the statement said.

“People rightly place a high level of trust in systems that hold their health data, and we understand the concern this situation may create for patients, providers, and partners.”

Police confirmed they were notified of the breach at 12.15pm on New Year’s Day and the National Cyber Security Centre (GCSC) confirmed it was working with Manage My Health to “remediate” the situation. Neither police nor GCSC could confirm if a ransom was demanded.

The Post asked duty Government minister Karen Chhour and Te Whatu Ora Health NZ about the likelihood of a ransomware attack, whether anyone behind the unauthorised access had communicated their intention and whether there was a risk of patient information being released.

They were also asked how many patient files were affected and whether Health Minister Simeon Brown was being called in from the summer break.

In a statement, Chhour said the situation was “incredibly concerning for patients”.

“The Minister of Health has asked for urgent assurances from Health NZ and Manage My Health that everything is being done to protect patient data and patient privacy,” she said.

“We also expect Manage My Health to communicate transparently to ensure public confidence in their product.”

Wellington mayor Andrew Little, who was the Health Minister during a 2021 Waikato health system breach, confirmed hackers wanted a ransom that time. The latest breach was serious and Manage My Health had to warn people affected, and tell them what to do to protect private data, he said.

Auckland University Professor Gehan Gunasekara, who specialises in privacy law, said the previous health ransomware attack in Waikato came with a ransom demand. Private health information was reportedly released on the dark web when it was not paid.

“It is concerning,” he said. “These attacks are becoming more and more common.”

There was no fail-safe way to stop them and, while he did not know if funding cuts allowed this one to happen, government money had been cut in the past year.

Labour health spokesperson Ayesha Verrall said the breach was a concern for anyone who used the Manage My Health site. It was “not good enough” that the platform had not directly contacted users. She used the site recently and had not heard from it.

The Post has been unable to directly contact Manage My Health.

The Government Communications Security Bureau and Privacy Commissioner ‒ both looped in during a similar breach in Wellington in 2019 ‒ have been asked if they are now involved.

The National Cyber Security Centre issued advice in 2021 that government agencies should not pay cyber ransoms​. The Privacy Act says organisations should tell affected people as soon as possible if a ransomware breach of their data is likely to cause anyone serious harm.