New Zealand Privacy Commissioner Issues Compliance Notices After Major Data Breach

• •Nearly 100,000 health records were exposed in a cyberattack on Manage My Health.
• •Both Manage My Health and Health NZ were found liable for inadequate security measures.
• •Compliance deadlines set for both organizations to improve data protection measures.

New Zealand's Privacy Commissioner, Michael Webster, issued compliance notices on September 23, 2026, to Manage My Health and Health NZ following a cyberattack in December 2025 that compromised health records of nearly 100,000 individuals. The attack targeted Manage My Health, which operates the largest patient health portal in New Zealand, resulting in the exposure of 403,730 Health NZ documents and 22,609 patient-uploaded documents. The breach primarily affected individuals in Northland, with 90% of those impacted residing there. The Privacy Commissioner found both organizations liable for failing to maintain adequate security controls, including deficiencies in access control and multi-factor authentication. Manage My Health has until August 31, 2027, to comply with the requirements, while Health NZ must meet its obligations by January 29, 2027. No financial penalties were imposed, but the Commissioner emphasized the importance of treating patient data securely.