48 hours to pay: Manage My Health quiet as deadline brought forward to Tuesday
Sunday, 4 January 2026
Health portal Manage My Health, the target of a ransomware attack that accessed personal health records of about 120,000 Kiwis, is refusing to address the issue of the deadline to pay being brought forward to Tuesday.
Manage My Health, which is used by about 1.8 million New Zealanders, was the target of a December 30 ransomware attack. The “health documents” part of the website for 6% to 7% of users was the area that was accessed.
The Auckland-owned company confirmed a US $60,000 ($104,000) ransom was demanded while The Post on Saturday confirmed that about 30 files – some deeply private – were already on the dark web. It is understood a January 15 deadline had been set for payment with Manage My Health not willing to say if it would pay.
READ MORE:
On Sunday morning, a user posted online that the deadline was now within the next 48 hours or “we will leak everything”. The Post has been unable to contact the alleged hacker to verify the claims.
Te Whatu Ora Health NZ confirmed Manage My Health had notified it of the shortened deadline.
A spokesperson for Health Minister Simeon Brown would not say whether the minister was aware of the 48-hour deadline and said it was a matter for Manage My Health. He had asked for advice on options for an independent review of the breach.
Colin Kennedy, who was earlier acting as a spokesperson for Manage My Health, could not comment on the deadline and said he would get an external public relations firm to comment. Manage My Health chief executive Vino Ramayah would not answer his phone or text messages on Sunday morning.
But via a written statement from public relations firm Alexander, the company said: “Manage My Health is unable to comment on any ransom request as this is a matter for the police.” Police could not immediately confirm if they were aware of the new deadline.
Police previously confirmed they were notified of the breach two days after it occurred.
Green health spokesperson Hūhana Lyndon, who had not independently verified the 48-hour deadline, said it was “unsettling” as some of the already released information was “really personal”.