What happened
In December 2025 the Manage My Health patient portal suffered a cyber attack in which documents were stolen and offered for sale; the hacker demanded a ransom (US$60,000) and threatened publication [rnz-mmh], [rnz-mmh-timeline]. The hacker’s claim was posted on 30 December and Manage My Health confirmed the breach on 31 December 2025 [rnz-mmh-timeline]. The company’s early upper estimate was about 126,000 users (6–7% of around 1.8 million) [rnz-mmh]; the Privacy Commissioner later put the figure at nearly 100,000 New Zealanders, about 91% of them Northland hospital patients [opc-mmh-phase1-release].
The Privacy Commissioner opened a formal inquiry. Its Phase One report found that both Manage My Health and Health NZ breached Rule 5 (storage and security) of the Health Information Privacy Code [opc-mmh-phase1-release], [pc-mmh].
Timeline
- 2025-12-30 — A hacker posted a claim to hold stolen Manage My Health documents [rnz-mmh-timeline].
- 2025-12-31 — Manage My Health confirmed the breach [rnz-mmh-timeline].
- 2026-05-27 — Privacy Commissioner released the Phase One inquiry report, finding both Manage My Health and Health NZ breached Rule 5 [opc-mmh-phase1-release], [pc-mmh].
- 2026-09-23 — Privacy Commissioner issued compliance notices to Manage My Health (deadline 31 August 2027) and Health NZ (deadline 29 January 2027) [opc-mmh-compliance].
- 2026-10-30 — Final Phase Two report published, addressing the impacts, especially on Northland and Māori patients [opc-mmh-phase2], [opc-mmh-inquiry].
Current status
Regulator action taken: the Privacy Commissioner’s inquiry has concluded with both reports published, and compliance notices requiring changes have been issued to Manage My Health and Health NZ, with deadlines in 2027 [opc-mmh-compliance], [opc-mmh-inquiry]. Compliance notices are not a monetary penalty; no fine has been imposed.
Why it matters
One of the few New Zealand breaches to draw a formal regulator inquiry with published findings and compliance notices — a Tier-A case that shows the direction of NZ privacy enforcement.