Deadline Passed, Trust Tested: New Zealand Grapples with Manage My Health Fallout

In an age when health information flows through screens as readily as conversations with a doctor, a breach of that digital trust can leave patients feeling exposed and uncertain. New Zealand’s Manage My Health, the country’s largest patient portal hosting records for about 1.8 million users, finds itself at the centre of mounting criticism over its handling of a cyber attack and data breach first disclosed on 30 December 2025. As another ransom deadline passes — reportedly extending into the early hours of Friday after claimed demands from an extortion group — frustration over delays in communication, patchy notifications and opaque responses from the service has grown louder among patients, clinicians and sector advocates.

The breach, believed to involve the exfiltration of hundreds of thousands of sensitive medical documents from the platform’s “My Health Documents” module, has shocked many in New Zealand, not least because some records date back years and include highly personal information. While Manage My Health says the core patient database and clinical systems were not accessed and has been working with forensic specialists to secure its systems, the pace and clarity of public updates have fuelled disquiet. Practitioners and general practice organisations have described parts of the platform’s response as “shambolic, frustrating and slow,” pointing to inconsistencies in information given to clinics and patients about who has been affected and how.

A central gripe among GPs is the lack of precise, timely notification: some practices were told only the number of affected patients without names, while others received lists, leaving many clinicians struggling to advise their patients effectively. Patients themselves have recounted being first informed of the breach through media coverage, only later receiving confirmation from the portal. In one case, a woman was initially told she was not affected, then received a second email two days later saying she had been compromised — a reversal that left her anxious and uncertain how to respond.

For people with sensitive histories — including survivors of sexual violence and family harm — the stakes are deeply personal. Some have expressed fear that revelations of past injuries or conditions could re‑traumatise them if documents are disclosed, lamenting that having entrusted such intimate information to a health provider now feels like a breach of confidence rather than a clinical tool.

Cybersecurity experts have also weighed in, questioning the organisation’s wider cyber posture and pointing to missed opportunities for basic protections. Independent analysis suggests that credential‑based intrusions or automated scraping tactics — rather than a breach of core systems — may have enabled access to the document module, raising concerns about access controls and rate limiting that should be standard in healthcare systems.

Manage My Health’s leadership acknowledges the distress caused and says that direct patient notifications are underway — as of the latest updates, about 50 per cent of affected patients had begun receiving emails with support contacts and guidance — and that it is working with Health NZ, police, privacy authorities, and general practices to coordinate communications. Yet for many users and clinicians, the ongoing lag in full disclosure and support has left lingering questions about preparedness, transparency and accountability in safeguarding health data.

In the wake of the incident, the Health Minister has commissioned a review of the breach and response, and a High Court injunction now restrains the use or dissemination of stolen documents. But as deadlines come and go, the debate over how seriously healthcare cybersecurity is taken — and how swiftly patients are protected when things go wrong — shows no sign of abating. For those whose most private medical details lie behind screens, the quest for clarity continues.

AI Image Disclaimer “Visuals are created with AI tools and are intended for representation only, not real photographs.”

Sources Criticism of Manage My Health cyber attack response mounts as another deadline passes — RNZ News. New Zealand health data ransom: Why ‘Kazu’ hackers extended their deadline — Malay Mail. Manage My Health breach: 50% of affected patients contacted — 1News. Patients ask GPs for info on health records after Manage My Health security breach — RNZ News. ‘One part terrified, one part really angry’ — Assault victim’s anger over Manage My Health hack — SecurityBrief.co.nz.