Further to our 6 January 2026 statement regarding the cybersecurity incident, Manage My Health provides the following update.
Direct notification of affected patients and enforcing injunction orders preventing third parties from accessing any stolen data are the foremost priorities for Manage My Health this week.
Police advice
Police advice is that third parties should not engage directly with criminal hacker groups, including in this situation. Doing so is not in the best interest of those impacted by this incident and can have un-anticipated consequences.
Patient notifications
Manage My Health will begin notifying patients in the next 24 hours and we hope to complete this process by early next week. Notifications will be sent initially through email to the address that was used to register the account.
MMH has been liaising with Health New Zealand, the OPC, GPNZ, and GP practices to ensure patients receive clear, consistent information and do not receive multiple or confusing notifications from different organisations about the same incident.
The email notifications will include an 0800 number that impacted individuals can call to get support and assistance should they require.
Advisory Board
MMH is establishing an advisory board providing added clinical and technical support in the management of this unprecedented criminal cyber incident. One appointee has been announced today and further appointees will be announced over the coming days.
Ross Tanner has been appointed as an advisor on privacy matters and governance for Manage My Health. He is a seasoned governance and public‑sector management expert with extensive career experience in the State sector including senior management roles in Government departments and participation on the boards of Crown entities (including serving as a former Deputy State Services Commissioner) and private companies. Ross has also chaired a number of voluntary sector boards.
The High Court injunction orders – final sealed injunction paper
Manage My Health has obtained injunction orders on an interim basis from the High Court preventing third parties from accessing any stolen data, as noted in our 6 January update.
We continue to work around the clock and closely with authorities and agencies to respond to this incident and resolve the matter for patients and general practices.
We sincerely apologise for the pain and disruption that this incident has caused to our providers and patients as a result of this criminal activity against our systems.
Manage My Health app and web application
In preparation for notification of users, the Manage My Health mobile app has been redirected to the Manage My Health web application so that notification information can be consistent across platforms. Visitors to our app will see a pop-up notification alerting them to this. This is intentional. The mobile app will be restored in time and users will be notified of this.
As noted in our 3 January update, we identified and closed the specific gap that allowed unauthorised access, which has been fixed and independently tested and verified by external cybersecurity experts.
FAQs
For any further information, please refer to our frequently asked questions here: FAQs – Cyber Breach | Manage My Health
As always, if any patients or practices have any concerns or questions, please contact us directly via [email protected]
Our regular updates can be found here: www.managemyhealth.co.nz
