Massive Data Breach Exposes Health Information of Nearly 100,000 New Zealanders

• •Nearly 100,000 New Zealanders' health data was compromised in a major breach.
• •The attack exploited weak security practices and a unique data-sharing arrangement.
• •The Privacy Commissioner plans to enforce compliance notices to improve security measures.

In December 2025, the Manage My Health platform suffered a significant cyber attack, compromising sensitive health data of approximately 100,000 New Zealanders. The breach was attributed to inadequate security safeguards, including poor monitoring and risk management practices. Most affected individuals were located in Northland, with many being Māori, due to a unique data-sharing arrangement between Health NZ and Manage My Health. The Privacy Commissioner found both organizations breached the Privacy Act and intends to issue compliance notices requiring improvements. The breach was described as preventable, with researchers noting that the attack was neither sophisticated nor uncommon. Reports indicate that the stolen data included clinical notes and personal documents, raising concerns about potential identity theft and blackmail. The Ministry of Health is now implementing stronger cybersecurity measures across the health sector in response to the incident.