Manage My Health Breach: What the Privacy Commissioner Found

TL;DR: In December 2025 attackers stole more than 400,000 medical documents from the Manage My Health patient portal, affecting roughly 120,000 to 127,000 of its 1.8 million users. In May 2026 the Privacy Commissioner found that both Manage My Health and Health NZ breached Rule 5 of the Health Information Privacy Code, and said it would issue compliance notices. About 91% of affected people were Northland hospital patients. Affected patients can now make privacy complaints.

👉 Check my digital footprint — free 30-second check →

What happened

Manage My Health is a privately run portal that GP practices use to give patients access to their records. According to the Wikipedia summary of the breach:

the company learned of unauthorised access on 30 December 2025;
roughly 6–7% of its 1.8 million users (about 120,000–127,000 people) may be affected;
more than 400,000 documents were taken, including referrals, discharge summaries, lab results and imaging reports;
a group calling itself “Kazu” demanded US$60,000 and published samples;
on 6 January 2026 the High Court granted injunctions barring anyone from publishing or using the stolen data.

The company said usernames, passwords and core clinical systems weren’t compromised, and that access was limited to a document storage module.

What the Privacy Commissioner found

On 27 May 2026 the Privacy Commissioner published Phase 1 findings:

Both Manage My Health and Health NZ breached Rule 5 of the Health Information Privacy Code, the rule on keeping health information secure.
About 91% of affected people were patients of Northland hospitals, because Health NZ had a local arrangement to share discharge information through the portal that didn’t exist in other regions. Many affected patients are likely to be Māori.
Health NZ’s project lacked specialist privacy and security staff, leaned too heavily on the vendor’s security claims, and used a contract that was too generic.
Manage My Health had security gaps and no systems to detect large-scale data access.
GP practices are not liable, as they couldn’t have prevented it.
The Commissioner intends to issue compliance notices to both organisations.

Phase 2 will look at patient authorisation, data retention, breach communications and the impact on Northland Māori.

Why health data is different

You can cancel a credit card. You can’t cancel a diagnosis. Stolen medical documents can be used for extortion (“pay or we tell your employer”), for very convincing phishing (“Your specialist referral needs updating”), and for identity fraud using the personal details on letters.

What affected patients can do

Make a privacy complaint if you were affected. The Commissioner’s office says it can now consider complaints.
Be wary of any message that mentions your health details, a hospital stay or a referral and asks you to click, pay or confirm information. Call your GP on a number you already have.
Never pay anyone who threatens to release your records. Report it to Police on 105 and to Netsafe.
Lock down your email with a strong unique password and two-factor authentication, because your email is the key to every portal you use.

Check what else is out there

A breach like this adds to whatever is already circulating about you. A free email exposure check shows which known breaches include your email address, and our guide to medical identity theft explains the warning signs.

Update: compliance notices issued (September 2026)

The Privacy Commissioner has now issued the promised compliance notices, as reported by NZ Lawyer on 29 September 2026:

Agency	Rule	Deadline
Manage My Health	Rule 5(1)(a): reasonable security safeguards	31 August 2027
Health NZ	Rule 5(1)(b): steps before health information is given to a service provider	29 January 2027

The Commissioner had identified seven areas of ineffective security. Manage My Health has already improved three: multi-factor authentication, restricting user access and controlling unauthorised external access.

Frequently Asked Questions

How many people were affected by the Manage My Health breach?

Roughly 120,000 to 127,000 people, about 6–7% of the portal’s 1.8 million users, with more than 400,000 documents taken.

What did the Privacy Commissioner find?

That Manage My Health and Health NZ both breached Rule 5 of the Health Information Privacy Code on security, and that compliance notices would be issued.

Why were Northland patients most affected?

Health NZ had a Northland-only arrangement to share hospital discharge information through the portal. About 91% of affected people were Northland hospital patients.

Can I complain if my records were taken?

Yes. The Privacy Commissioner’s office says it can now consider complaints from affected people.

Manage My Health Data Breach: The Privacy Commissioner's Findings and What Patients Can Do