FAQs – Account Security Status
1. How do I check my Account Security Status?
Log in to your Manage My Health account. Your Dashboard will clearly show your Account Security Status, stating whether your account was impacted or not impacted. You can click “Check now” to view more details.
If you don’t see the Account Security Status, it means your account is still under review. Reviews are being completed in phases, and this does not indicate that your account has been impacted.
2. Has my personal or health information been accessed, and how do I know if my account was impacted?
Based on our investigation, we believe that approximately 5-6% of users were affected by this incident. If your information was involved, Manage My Health will contact you directly with confirmation and next steps.
You can also check your status by logging in to Manage My Health. Your Dashboard will show whether your account was impacted or not impacted, and you can click “Check now” to view further details on the Account Security Status page.
If you don’t see the Account Security Status, it means your account is still under review. Reviews are being completed in phases, and seeing “under review” does not indicate that your account has been impacted.
3. Why did it take time to confirm which documents were affected?
Time was required to ensure accurate information was shown to the correct users. Manage My Health introduced the Account Security Status so users can see verified, document-level information specific to their account.
If you don’t see the Account Security Status, it means your account is still under review.
4. If I have not received an email, does that mean my account was not affected?
At this stage, users who have an active MMH identified as impacted have been contacted directly. If your account status changes, Manage My Health will contact you.
You can also verify your status by logging in and checking your Account Security Status on the Dashboard, or by clicking “Check now”. If you don’t see the Account Security Status, it means your account is still under review.
5. Why am I being directed to the Manage My Health web application?
Manage My Health is temporarily directing users to the web application to ensure consistent access to information and support. The web application displays your Account Security Status on the Dashboard and allows you to view details by clicking “Check now”.
6. What safeguards are in place to prevent unauthorised access to Manage My Health and provide assurance about the security of patient information?
Internationally recognised cybersecurity experts have tested the current application and environment and confirmed that it is safe and secure. We also recommend that users enable multi-factor authentication to protect their accounts. We take the security of the application very seriously and continue to invest in monitoring, testing, and improvement to reduce risk and prevent unauthorised access.
FAQs – Information Involved
7. What type of information was involved?
The incident relates to documents stored in the My Health Documents section. This includes:
- Documents users uploaded themselves, such as correspondence, reports, or results
- Clinical documents from Northland hospital including outpatient clinics. Examples of clinical documents are hospital discharge summaries, clinic letters and operation reports.
This did not include GP clinical systems, live medical records, prescriptions, secure messaging, or appointment systems.
8. Does this breach affect my GP, clinic, or hospital records?
No. GP clinical systems, hospital systems, prescriptions, secure messaging, and appointment systems were not affected.
9. Were any live medical records or GP notes accessed?
No. Live medical records, GP notes, prescriptions, secure messaging, and appointment systems were not accessed or affected.
10. What does “accessed” mean, and is that the same as “downloaded”?
“Accessed” means an unauthorised party may have viewed or opened files. “Downloaded” means files were copied out of the environment. Independent forensic analysis is being used to confirm what was accessed and what may have been downloaded.
An account is marked as “impacted” based on forensic identification, regardless of whether documents were viewed or downloaded.
FAQs – Cyber Breach Incident
11. What happened to Manage My Health in the cyber security incident?
Manage My Health identified a cyber security incident involving unauthorised access to a specific feature of the platform in New Zealand. The issue has been contained, the affected feature secured, and independent international cyber security specialists have been engaged to investigate and confirm the impact.
12. Is the Manage My Health platform safe to use?
Yes. The unauthorised access has been contained. The platform remains operational, and independent cyber security specialists have confirmed the current system environment is secure and operating as intended.
13. Is the cyber security incident still ongoing?
No. The unauthorised access has been contained, and the affected feature has been secured. Ongoing monitoring remains in place.
14. What is Manage My Health doing in response?
Manage My Health has secured the affected feature, engaged independent cyber security specialists, notified regulators, and implemented additional safeguards and monitoring. We are working with the Office of the Privacy Commissioner, New Zealand Police, and Health New Zealand.
15. Have you notified the Office of the Privacy Commissioner?
Yes. The Office of the Privacy Commissioner has been notified, and Manage My Health is working with Health New Zealand and other relevant agencies.
16. Who is overseeing the response to this incident?
The response is being managed by Manage My Health with support from independent cyber security specialists and in coordination with the Office of the Privacy Commissioner, Health New Zealand, and New Zealand Police.
FAQs – What You Should Do
17. Do I need to change my password or take any action?
As a precaution, change your password, especially if you reuse it across other services. Users can also enable multi-factor authentication (MFA) for additional security.
18. How do I know an email or call is really from Manage My Health?
Manage My Health will never ask for your password or one-time security codes. Be cautious of unexpected or urgent messages.
19. What should I do if someone contacts me claiming to have my health information?
Do not engage with them. Contact New Zealand Police on 105, or 111 in an emergency, and report the matter to the Manage My Health support.
20. Should I be concerned about identity theft or scams?
Manage My Health has partnered with IDCARE, Australia and New Zealand’s identity and cyber support service. IDCARE provides free, confidential support for identity misuse or compromise.
21. Do I need to contact my GP, practice, hospital, or specialist?
No. You do not need to contact your GP, practice, hospital, or specialist unless they advise you to do so separately.
22. Will this incident affect my future care or access to services?
No. Your access to healthcare services and your ability to receive care are not affected.
23. I have heard that calls to the 0800 affected patient support number are not being answered. Is that correct?
No. The 0800 affected patient support line is being actively staffed and calls are being answered. Call volumes vary by day. The average wait time for a call to be answered is less than eight minutes.
FAQs – Your Account & Privacy
24. How do I delete documents or close my Manage My Health account?
You can delete individual documents you uploaded by accessing the My Health Documents folder.
To delete your Manage My Health account, follow these steps:
1. Log in to your Manage My Health account.
2. Go to your Profile section.
3. Select “Close Account” from the menu options.
25. What happens to my health information after I close my account?
Once your account is closed, your previously stored health records will be deleted from the portal and become permanently inaccessible, and they cannot be recovered.
26. Can I reopen my account later?
No. Because your portal records become permanently inaccessible once an account is closed, you would need to register again if you wish to use the Manage My Health portal in the future.
27. Can I request access to my personal information under the Privacy Act 2020?
Yes. You have the right to request access to your personal information under the Privacy Act 2020. Requests should be submitted through Manage My Health support and are handled within legal timeframes.
News & Updates related to Cyber Breach
MMH cyber breach update 22 January 2026
MMH cyber breach update Jan 22 2026 What happened? Manage My Health (MMH) experienced a cyber event that impacted a limited feature of our platform
MMH cyber breach update 13 January 2026
MMH cyber breach update, 13 January 2026 Further to our 12 January 2026 statement regarding the cybersecurity crime, Manage My Health (MMH) provides the following update. Update on patients affected MMH and forensic cybersecurity experts
MMH cyber breach update 12 January 2026
MMH cyber breach update 12 January 2026 Further to our 9 January 2026 statement regarding the cybersecurity crime, Manage My Health (MMH) provides the following
MMH cyber breach update 9 January 2026
MMH cyber breach update 9 January 2026 Further to our 8 January 2026 statement regarding the cybersecurity crime, Manage My Health (MMH) provides the following
MMH cyber breach update 8 January 2026
Further to our 7 January 2026 statement regarding the cybersecurity incident, Manage My Health (MMH) provides the following update. Direct notification of affected patients remains the foremost priority for Manage My Health this week. Patient notifications
MMH cyber breach update 7 January 2026
Further to our 6 January 2026 statement regarding the cybersecurity incident, Manage My Health provides the following update. Direct notification of affected patients and enforcing
MMH cyber breach update 6 January 2026
Further to our 5 January 2026 update regarding the cyber security incident, Manage My Health provides the following update. Direct communication with providers As communicated
MMH cyber breach update 5 January 2026
Further to our 3 January 2026 update regarding the cyber security incident we were notified of on 30 December 2025, Manage My Health provides the
MMH cyber breach update 3 January 2026
Further to our update issued on 2 January 2026 regarding the cyber security incident we were notified of on 30 December, Manage My Health is
MMH cyber breach update January 2026
Further to our update issued on 1 January 2026, Manage My Health is providing additional factual clarification as investigations continue. We recognise the public interest
Manage My Health update on cyber security incident
Manage My Health was notified yesterday of a cyber-security incident involving unauthorised access to its New Zealand application. Since we were alerted, our team has