Canopy Healthcare Confirms July Cybersecurity Breach in New Zealand

The company stated that clinical systems, patient services, electronic health records, and appointments were not affected.

Canopy Healthcare, a leading oncology and diagnostic imaging provider in New Zealand, has confirmed a cybersecurity incident from 18 July 2025 involving unauthorised access to an administrative server.

The company stated that clinical systems, patient services, electronic health records, and appointments were not affected.

The provider, which operates four diagnostic clinics, eight oncology clinics, two private breast surgical and diagnostic centres, and a drug compounding business, said the breach was confined to administrative systems. Immediate measures were taken to secure systems and engage independent cybersecurity experts for a forensic investigation.

Canopy notified the New Zealand Police and the Office of the Privacy Commissioner and obtained a High Court injunction prohibiting any use or publication of potentially accessed data. The company noted that while the investigation is ongoing, most exposed information is considered to be of "low or no risk" to individuals. A small number of bank account details and some staff identity information may have been accessed, but patient identity documents remain secure. Affected individuals have been informed.

The company has not identified the responsible party and has received no contact from the unauthorised source. Canopy is monitoring for any misuse or distribution of data, with the court injunction remaining permanently in place.

The incident comes amid heightened cybersecurity concerns in New Zealand’s healthcare sector. Earlier, the patient portal operator Manage My Health disclosed a hack affecting up to 126,000 users, with hackers reportedly demanding a NZ$104,000 ($60,000) ransom. The Ministry of Health commissioned a review of that breach and the company’s response.

Stay tuned for more such updates on Digital Health News