Agencies ordered to improve security after major health data breach
Wednesday 23 September 2026 · 2 outlets · 2 reports · updated In this story Health New Zealand, Privacy Commissioner, Michael Webster
The Privacy Commissioner has issued compliance notices to Health NZ and Manage My Health following a cyberattack that exposed the data of 99,416 people. The breach, which occurred in December, affected many individuals in Northland. Both organisations have until next year to strengthen their protections for sensitive patient information.
Key facts
5 facts
- 99,416 patients had health data exposed in the breach
- The cyberattack occurred on 30 December 2025
- 90 percent of affected patients live in Northland
- Core clinical databases were not compromised
- Compliance notices were issued regarding rule 5 of the Health Information Privacy Code
The full story
1 min read · 2 outlets
Manage My Health and Health NZ have been ordered to improve security protections following a cyberattack that exposed the data of 99,416 patients. Privacy Commissioner Michael Webster issued compliance notices to both organisations after finding they failed to meet requirements to safeguard sensitive information during the late December 2025 incident.
The breach occurred on 30 December 2025 when attackers used stolen credentials to access the Manage My Health portal. Hackers exploited a vulnerability in the My Health Documents section to access files belonging to other patients. Stolen material included clinical correspondence, laboratory results, medical imaging reports, specialist referrals, hospital discharge summaries, and patient-uploaded documents.
The Privacy Commissioner noted the breach had a disproportionate impact on Northland, where 90 percent of the affected patients live. Webster stated, “I am thinking particularly of Māori in Northland, where 90 percent of the affected patients live whose data was stolen”.
Health NZ has until 29 January 2027 to complete required changes, while Manage My Health has until 31 August 2027. Manage My Health has already improved multi-factor authentication, user access restrictions, and controls to prevent unauthorised external access.
How it developed
- Wed 23 Sep, 11:56amThe breach involved 403,730 Health NZ documents and 22,609 documents uploaded by patients.
Where reports differ
- One report states 99,416 people were affected, while another reports that hackers compromised 403,730 Health NZ documents and 22,609 patient-uploaded documents.
Compiled from reports by Stuff and Otago Daily Times.