“Health, Privacy and Risk: New Zealanders Begin to Learn What Was Stolen”

A major breach in New Zealand’s largest online health record system has shifted from invisible cybercrime to direct concern for tens of thousands of patients, as the company behind the portal begins the difficult task of alerting people that their sensitive medical information may have fallen into the wrong hands. In a digital age where personal details are entrusted to interconnected systems, the unfolding notification process serves as a grim reminder of both our reliance on online health tools and the potentially profound consequences when security fails.

Manage My Health — an online patient portal widely used by general practices across New Zealand — confirmed this week that it will begin notifying affected individuals about a massive cybersecurity breach that exposed highly sensitive health records. The company said it aims to start sending notification emails to the addresses registered with patient accounts within about 24 hours, and hopes to complete the outreach by early next week.

The breach, first discovered around 30 December 2025, saw unauthorised access to private medical documents, with hackers claiming to have stolen hundreds of thousands of files that could include test results, clinical notes, and other personal health data. In some cases, stolen material was briefly posted online and later removed by the attackers.

Manage My Health has been working with Health New Zealand, the Office of the Privacy Commissioner, and other health partners to coordinate the notification process and ensure that patients and general practices receive consistent information about the incident, including how to seek support and what steps they can take to protect themselves. An 0800 support number will be included in the notifications for those who require assistance.

Some general practices have already contacted their own patients — even before the official notification process begins — urging them to check their accounts or close unused portal profiles, after discovering that historical records had remained accessible even for people who had changed providers. Critics have questioned why data was retained in this way and whether more proactive due diligence should have been undertaken to protect patient information.

Patients have voiced alarm over the breach, especially given the nature of the records accessed, and experts warn that the stolen information could be misused for identity theft, financial fraud or targeted social engineering if exploited by criminals. Authorities have stressed that affected individuals should beware of scams and never share passwords or verification codes.

As the notification process gets underway, what was once a technical breach has become a very human story — one involving real people being told that the private details of their health could be circulating beyond the healthcare system. For many affected, the incident raises urgent questions about data security, patient trust, and the obligations of digital health platforms to safeguard some of the most intimate aspects of personal life. The coming days, as alerts are delivered and support channels open, will be a crucial period for patients, providers, and regulators alike.

AI Image Disclaimer “Visuals are created with AI tools and are not real photographs, meant for conceptual illustration.”

Sources: Manage My Health: Patients start to be notified after massive leak (RNZ News); Manage My Health cyber breach update and notification details (Manage My Health official update).