TL;DR: On Sunday 22 February 2026, MediMap, a privately owned medication portal used by aged care, disability, hospice and community care providers, detected "unauthorised entry" and went offline. Attackers had altered patient records, marking living patients as deceased and changing names. The Aged Care Association said up to 60% of aged care facilities could be using it. PM Christopher Luxon called it "concerning, particularly when it follows Manage My Health," and the government’s cyber action plan now asks the Ministry of Justice to look at civil penalties for privacy failures.
What happened
According to RNZ (24 February 2026):
- MediMap found "unauthorised entry"; the problem began around 1:30pm on Sunday and the platform was put into maintenance mode as a precaution.
- Some patient information was altered, including records marking living patients as deceased. Some patients were relabelled with a stranger’s name.
- MediMap said the data involved included names, dates of birth, prescribers, location of care and resident status.
- It notified the Privacy Commissioner and NZ Police, brought in external cyber experts, and was being helped by the Ministry of Health. Health NZ activated its Cyber Incident Management Team.
Newstalk ZB also reported patients being wrongly marked dead and names being changed.
Who uses MediMap
MediMap records medication doses, handles e-prescribing, holds medication histories and connects care providers with pharmacies. RNZ reported that:
- the Aged Care Association said as many as 60% of aged care facilities could be using it;
- Hospice NZ said a number of hospices were affected and had switched to paper systems;
- the Nurses Organisation said Christchurch aged care sites were affected.
Hospice NZ chief executive Wayne Naylor said: "As far as we are aware, patient care has continued safely and has not been impacted greatly by the outage."
Why tampering is scarier than theft
A stolen record is a privacy problem. A changed medication record is a safety problem. Staff rely on these systems to give the right dose to the right person. Marking someone as dead in a care system is, to put it mildly, not a clerical inconvenience.
Who’s responsible?
Health NZ was clear about where the responsibility sits. Its spokesperson Darren Douglass said: "As a private company, MediMap is solely responsible for ensuring the security of its platform." MediMap director Geoffrey Sayer apologised for the disruption and concern.
The political fallout
- PM Christopher Luxon: "It’s concerning, particularly when it follows Manage My Health." He said he had been pushing for stronger cybersecurity laws.
- Associate Health Minister David Seymour: "New Zealand cannot afford to be the weakest link."
- The government’s Cyber Security Strategy 2026–2030 and Action Plan ask the Ministry of Justice to advise on civil penalties under the Privacy Act, which currently has no civil fines for poor security, and on a new offence for handling illegally obtained data (MinterEllison; our explainer).
- The Privacy Commissioner has also reported a 43% rise in serious breach notifications (more).
Context: a bad run for NZ health data
MediMap followed the Manage My Health breach, where hundreds of thousands of documents were stolen and the Privacy Commissioner later issued compliance notices (our guide).
If you or a family member uses aged care, hospice or disability services
- Ask the provider whether records were checked and corrected after the incident.
- Double-check medications and personal details at the next review.
- Be wary of calls or messages that mention the incident; verify through the provider directly.
- You can ask for a copy of health records to check they’re accurate (how).
Health breaches rarely travel alone. A free exposure check shows which breaches your email appears in.
Frequently Asked Questions
What happened to MediMap?
Attackers got into the MediMap medication portal in February 2026 and altered patient records, including marking living patients as deceased and changing names. The platform was taken offline.
Who uses MediMap?
Aged care, disability, hospice and community care providers. The Aged Care Association said up to 60% of aged care facilities could be using it.
Was patient care affected?
Hospice NZ said that, as far as it knew, care continued safely; affected hospices switched to paper systems.
Did the government respond?
PM Christopher Luxon called it concerning, and the government’s cyber action plan asks the Ministry of Justice to explore civil penalties for privacy failures.
Does the NZ Privacy Act fine companies for poor security?
Not currently. The government has asked the Ministry of Justice to advise on a civil penalty regime.
Sources
- RNZ: Patient data changed as major NZ health app MediMap hacked (24 Feb 2026)
- Newstalk ZB: MediMap hack investigation after patients wrongly marked dead
- MinterEllison: Government releases NZ Cyber Security Action Plan (16 Mar 2026)