What happened
Manage My Health Limited, a New Zealand healthcare provider, suffered a cyber incident that was notified to the Privacy Commissioner on January 1, 2026. [opc-notification-guide] The breach affected approximately 126,000 patients and exposed around 400,000+ medical documents and records. [opc-announcement] On January 28, 2026, the Privacy Commissioner announced a formal Inquiry into the cyber security breach and Manage My Health’s handling of personal information. [opc-statement-jan28]
Data exposed
Medical records and documents containing patient personal and health information. The exact scope of data types exposed (diagnoses, treatment details, prescriptions, etc.) remains partially under investigation, though health records are confirmed compromised. [opc-announcement] Approximately 126,000 patients were affected; 400,000+ medical documents are feared exposed. [opc-announcement]
Timeline
- 2026-01-01 — Manage My Health notifies Privacy Commissioner of cyber incident.
- 2026-01-12 — Office of the Privacy Commissioner releases public guidance and support resources for affected individuals.
- 2026-01-28 — Privacy Commissioner announces formal Inquiry into the cyber security breach affecting Manage My Health. [opc-statement-jan28]
- 2026-09-10 — Inquiry ongoing; no determination or findings released as of this date.
Regulatory outcome
Active Privacy Commissioner Inquiry. The Office of the Privacy Commissioner has initiated a formal compliance investigation into whether Manage My Health took reasonable steps to protect personal information and comply with the Privacy Act 2020. The Privacy Commissioner’s investigation is ongoing and no formal determination or penalty has been issued as of September 10, 2026.
Why it matters
Manage My Health’s breach represents one of the most significant healthcare data compromises in New Zealand’s recent history. The Privacy Commissioner’s decision to launch a formal Inquiry signals heightened regulatory scrutiny of healthcare organisations’ cybersecurity and data protection practices. The case will provide guidance on reasonable steps obligations for health record custodians under the Privacy Act 2020, particularly regarding the protection of sensitive medical information.
Status note: Privacy Commissioner investigation is active and ongoing. Formal findings, determinations, or any enforcement action (if pursued) have not yet been released. This record will be updated as the investigation concludes.