Manage My Health Patient Portal Breach Affects 126,000 Users in New Zealand

Manage My Health confirmed it had closed gaps that allowed the breach, adding extra login checks and limiting rapid access attempts.

A cyber breach at New Zealand’s popular patient portal, Manage My Health, has affected up to 126,000 users, the company confirmed on New Year’s Day. The incident was first detected on December 30, 2025, and involved unauthorized access to the portal.

In a follow-up update, Manage My Health said an independent forensic analysis identified a single compromised module, Health Documents, while the rest of the application remained secure and operational. "Manage My Health is commencing legal action to protect our clients' data," the company stated.

The breach impacts approximately 6–7% of the portal’s 1.8 million registered users. Notifications to affected users are expected to start following verification by the forensic team and coordination with primary health organizations and general practices. An online helpdesk and dedicated support number are set to go live early next week.

Manage My Health confirmed it had closed gaps that allowed the breach, adding extra login checks and limiting rapid access attempts. The company also said all health documents have been re-secured with strengthened storage protocols, validated by external cybersecurity experts.

This breach follows a history of IT incidents in New Zealand healthcare. In October 2024, Te Whatu Ora Central Region experienced a hack that targeted staff information and medical assessments. In 2022, another cyberattack affected 14,000 records from Te Whatu Ora’s IT service providers, while the Pinnacle Midlands Health Network also reported a breach that year.

Jason Power, acting national director of Planning, Funding, and Outcomes at Te Whatu Ora Health New Zealand, confirmed the Manage My Health breach had no impact on Health NZ systems. Te Whatu Ora’s incident management team, along with General Practice New Zealand, is coordinating the response. The Office of the Privacy Commissioner and the New Zealand Police have also been notified.

Health Minister Simeon Brown emphasized the sensitivity of patient information: “Patient data is incredibly personal, and whether it is held by a public agency or a private company, it must be protected to the highest of standards.”

The Ministry of Health has commissioned a review of the breach and the company’s response to ensure the integrity of patient data across private and public systems.

Stay tuned for more such updates on Digital Health News