What happened
In 2026 the Manage My Health patient portal suffered a ransomware attack affecting around 126,000 patients, with a threat to release documents [rnz-mmh]. The New Zealand Privacy Commissioner opened a formal inquiry; its Phase One report faulted both the operator and Health NZ over the handling of the breach [pc-mmh].
Timeline
- 2026 — Ransomware attack on the Manage My Health portal; ~126,000 patients affected [rnz-mmh].
- 2026-05 — Privacy Commissioner released the Phase One inquiry report [pc-mmh].
Current status
Under a Privacy Commissioner inquiry; Phase One findings released. [pc-mmh]
Why it matters
One of the few New Zealand breaches to draw a formal regulator inquiry with published findings — a Tier-A case that shows the direction of NZ privacy enforcement.