Manage My Health (MMH) acknowledges the serious nature of the December 2025 cyber security incident and the distress and concern it has caused patients, healthcare providers and the wider community. We apologise for this occurrence and for the impact it has had on those affected.
MMH is responding to the Office of the Privacy Commissioner’s Phase One report, alongside reviews undertaken by the Ministry of Health and Health New Zealand. These reviews examine different aspects of the incident, including privacy safeguards, cyber security, system design, and the broader sector response.
The reports confirm that this was a deliberate criminal attack by an unauthorised third party involving the use of compromised credentials and the exploitation of a specific vulnerability. The affected data was limited to the “My Health Documents” area of the platform, with no evidence of compromise to core patient portal systems and their integration with GP practice management systems. We recognise that any breach of trust is significant and we take that responsibility seriously.
Since the incident, MMH has undertaken a comprehensive programme of security and operational improvements. These include mandatory multi-factor authentication for all users, enhanced real-time monitoring and alerting capability, strengthened access controls, and expanded independent security testing across the platform.
We are continuing to work constructively with regulators and sector partners to demonstrate that our controls are in place and operating effectively.
The reviews also highlight broader challenges across digital health, including the need for stronger vendor assurance and more consistent security standards across the sector. MMH supports these findings and the opportunity for system-wide improvement.
At the time of the incident, the platform supported a Health New Zealand programme providing patients at Northland Hospital with digital access to their health information. While this delivered clear benefits for patient access and care, it also introduced complexity in how information was matched, stored, and accessed.
We are not aware of any information obtained in the breach being publicly released beyond the initial sample shared by the threat actor. Ongoing dark web monitoring is in place, supported by High Court injunctions to restrict access to and further distribution of the data.
Notifying affected individuals was a complex process involving approximately 99,000 people. This required careful balancing of urgency, accuracy, and patient safety, and involved extensive coordination with key stakeholders. We acknowledge the challenges experienced during this process.
Our priority throughout has been to support those impacted. MMH established and continues to provide support services for impacted patients following the incident, including a dedicated helpline, identity protection services and mental health and wellbeing support.
MMH has supported New Zealand’s healthcare sector for more than 18 years and remains committed to protecting patient information and supporting safe digital access to care.
Cybersecurity is an evolving and shared challenge across healthcare. We will continue to invest in security, strengthen governance and independent assurance and work collaboratively with the sector to support a more resilient digital health system. MMH has increased its cybersecurity vigilance and governance by appointing an independent advisory board to assist in clinical governance, privacy and security.
MMH continues to invest in its technology, people, and processes tostrengthen security and ensure the platform remains trusted, resilient, and fit for the future.
