Manage My Health NZ

08/01/2026

𝗠𝗠𝗛 𝗰𝘆𝗯𝗲𝗿 𝗯𝗿𝗲𝗮𝗰𝗵 𝘂𝗽𝗱𝗮𝘁𝗲 𝟴 𝗝𝗮𝗻𝘂𝗮𝗿𝘆 𝟮𝟬𝟮𝟲

Further to our 7 January 2026 statement regarding the cybersecurity incident, Manage My Health (MMH) provides the following update.

Direct notification of affected patients remains the foremost priority for Manage My Health this week.

𝗣𝗮𝘁𝗶𝗲𝗻𝘁 𝗻𝗼𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀
Direct notifications to the first 50% of patients affected commenced this morning.

Notifications are being sent via email to the address patients used to register their account, and this communication will be personally addressed to the name associated with the account. A reminder that patients should keep an eye out for anything unusual – MMH will never ask for log-in credentials – and that we are intentionally redirecting MMH mobile app users to the MMH web application so that notification information is consistent across platforms.

These email notifications will include an 0800 number that impacted individuals can call for support and assistance should they require.

𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗲 𝗻𝗼𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀
MMH has been communicating with general practices daily since first notifying practices on 31 December that a cyber incident had occurred. Resources are being shared this week with practices, both with affected patients and not, this week to support practices with communications to their patients.

𝗕𝗿𝗲𝗮𝗰𝗵 𝗰𝗼𝗻𝘁𝗮𝗶𝗻𝗺𝗲𝗻𝘁
We understand and sincerely apologise for the pain and anxiety this criminal activity has caused to our providers and patients.

The MMH app consists of multiple modules. One of these contains data provided directly by a GP and is referred to within the app as “Health Records”. The app also includes a separate module called “My Health Documents”, which stores documents, including those uploaded by users.

MMH would like to clarify that the breach was limited to data stored in the “My Health Documents” module only. User data stored in the GP-provided “Health Records” module was not compromised as part of this incident.

Here’s a summary of the facts, to date:

• The cyber incident was limited to 6-7% of our 1.8 million registered users, within the “My Health Documents” module only
• The data relates to a range of medical practices, including:
• Approximately 45 Northland-based GP practices;
• Clinical discharge summaries and historical clinical referral records in the Northland region (data that is between six and eight years old)
• Approximately 355 “referral-originating” GP practices across a number of New Zealand regions
• Personal health information uploaded by patients

𝗡𝗼𝗿𝘁𝗵𝗹𝗮𝗻𝗱 𝗽𝗿𝗮𝗰𝘁𝗶𝗰𝗲𝘀
Our investigation has shown that the data taken originates predominantly from the Northland region; documents that were shared with patients through the My Health Documents module and subject of the unauthorised access.

We recognise the disproportionate impact that this incident has had on some Northland communities. We are working closely with Health NZ/Te Whatu Ora as the data controller for Northland region documents to ensure those affected receive appropriate support and information.

𝗦𝘆𝘀𝘁𝗲𝗺 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆
We can confirm that we received independent confirmation from our cyber security specialists that the current system environment is secure and operating as intended.

MMH is an ISO 9001 and ISO 27001 certified organisation. We have quality assurance processes with regular testing of our systems.

𝗣𝗮𝘁𝗶𝗲𝗻𝘁 𝗱𝗮𝘁𝗮
Manage My Health does not automatically delete patient accounts or data when a practice stops using the platform. For example, many MMH users have signed up for accounts that are not linked to doctors and use the many features of the application that are not related to communications with their GP. In addition, many patients change doctors / practices while keeping their MMH account. Accounts remain active unless the patient chooses to close their account, whereupon the data is deleted.

𝗔𝗱𝘃𝗶𝘀𝗼𝗿𝘆 𝗕𝗼𝗮𝗿𝗱
Honorary Clinical Advisor Emeritus Professor Murray Tilyard ONZM has been appointed as an Honorary Clinical Advisor to the Manage My Health Board. Professor Tilyard brings more than three decades of leadership in New Zealand general practice, research and clinical governance. He is Emeritus Professor and former Chair/Head of General Practice at the Otago University (Dunedin) School of Medicine (1993–2022 Prof Tilyard continues to hold a practicing certificate and is a Distinguished fellow of the RNZCGP.

In this advisory role he will provide independent expert clinical advice to Manage My Health senior team and board, and strengthen Manage My Health’s clinical governance, decisions and patient communications following the recent cyber incident.

Professor Tilyard’s appointment is to provide patients, clinicians, and stakeholders additional confidence that decisions affecting individual patients, and in particular vulnerable patients, have senior clinical oversight and guidance.

𝗛𝗶𝗴𝗵 𝗰𝗼𝘂𝗿𝘁 𝗼𝗿𝗱𝗲𝗿 𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗻𝗴 𝗽𝗮𝘁𝗶𝗲𝗻𝘁 𝗱𝗮𝘁𝗮
MMH has sought further protection to prevent third parties from accessing any data based on injunction orders from the High Court. The order has been served to major media outlets. We have an international team monitoring known data leak websites and are prepared to issue takedown notices immediately if any information is posted.

As a precaution, patients are encouraged to change their passwords and use multi-factor authentication, especially if they reuse passwords across other services.

𝗣𝗼𝗹𝗶𝗰𝗲 𝗮𝗱𝘃𝗶𝗰𝗲 𝗿𝗲𝗴𝗮𝗿𝗱𝗶𝗻𝗴 𝘁𝗵𝗲 𝘁𝗵𝗿𝗲𝗮𝘁 𝗮𝗰𝘁𝗼𝗿
A reminder that Police advice is that third parties should not engage directly with criminal hacker groups, including in this situation. Doing so is not in the best interest of those impacted by this incident and can have unanticipated consequences.

𝗙𝗔𝗤𝘀
For any further information, please refer to our frequently asked questions here: https://managemyhealth.co.nz/faqs-cyber-breach/

As always, if any patients or practices have any concerns or questions, please contact us directly via info@managemyhealth.co.nz

Our regular updates can be found here: www.managemyhealth.co.nz

Find the answers to the most frequently asked questions related to the recent Cyber Breach.

06/01/2026

MMH cyber breach update 6 January 2026

Further to our 5 January 2026 update regarding the cyber security incident, Manage My Health provides the following update.

Direct communication with providers
As communicated in our last update, we have identified all patients whose documents may have been accessed in this incident. We have now notified the first group of affected general practices and unaffected practices in a communication that was distributed on the afternoon of 5 January.

Impact on the practices
We have advised the affected practices that the independent forensic investigation has confirmed that some patients associated with their practice have been affected, and are providing resources to help them respond to any patient inquiries.

Based on our findings, the incident was limited to 6-7% of our 1.8 million registered users of the ‘My Health Documents’ module on the Manage My Health app.

Information in the Manage My Health core module, in respect of appointments, prescription in the Health Record function have not been accessed and the portal has been independently confirmed as secure.

We have advised practices that the list of patients enrolled who have been impacted is available to the practice in the secure MMH Provider Portal. The MMH Provider Portal will state the name of the patient and the records accessed in the incident. We have recommended that practices review the list and advise us of any concerns about any vulnerable patients receiving notifications, so that we can provide appropriate support.

Features on the Manage My Health app which allow practices to see if they are affected have now also gone live to assist practices. We are working on a process to inform practices who have left Manage My Health.

Affected individuals
We are currently working through the Privacy Act notification process for each affected individual, in conjunction with Health NZ and the Office of the Privacy Commissioner.

The Privacy Act requires individuals to be notified when their information has been accessed in an unauthorised way. MMH is taking on this responsibility on behalf of the practices, to which the information is being provided so that practices can provide support after individuals have been notified. Privacy Act notifications will go to practices through Manage My Health, together with details of how more information and support can be accessed.

MMH will establish and promote an 0800 helpline number where impacted patients can get advice and support. Practices will also be notified of this helpline as soon as it is available so they can direct patients to it.

Features on the Manage My Health app will go live soon to allow affected individuals to determine whether any of their documents have been impacted in this cyber event.

Protecting Abuse of Data
Manage My Health has obtained injunction orders on an interim basis from the High Court preventing third parties from accessing any stolen data.

The orders:
1. Restrain third parties from accessing or in any way dealing with the stolen data.
2. Require that anyone with access to the stolen data or any information obtained from it immediately delete it.
3. Require that anyone immediately delete and take down any and all publications of or links to copies of the affected dataset or information obtained from it.

Formal sealed versions of the orders have been sought.

We continue to work around the clock and closely with authorities and agencies to respond to this incident and resolve the matter for patients and general practices.

We sincerely apologise for the pain and anxiety this incident has caused to our providers and patients, as a result of this activity against our systems.

Contact
In the interim, if any patients or practices have any concerns or questions, please contact us directly via info@managemyhealth.co.nz

FAQs
For any further information, please refer to our frequently asked questions here: FAQs - Cyber Breach | Manage My Health

Our regular updates can be found here:

Trusted by over 1.85 million Kiwis and used by most health centres, Manage My Health is a secure health portal that empowers people to take charge of their

05/01/2026

MMH cyber breach update 5 January 2026

Further to our 3 January 2026 update regarding the cyber security incident we were notified of on 30 December 2025, Manage My Health provides the following update.

We sincerely apologise for the pain and anxiety this incident has caused to our providers and patients, as a result of criminal activity against our systems. We continue to work closely alongside Health NZ, the NZ Police and other agencies to respond to this crime.

We acknowledge we could have done a better job at communication, however, our priority was to secure patient data and work on the accuracy of all information before providing it to practices and patients. This has been our paramount consideration.

As we have said from the beginning, we strive to be transparent in our communications, and will be publishing daily updates with all the information we can share with you. There are constraints, both legal and practical to the fast dissemination of this information.

We want to assure the public that since the 30th of December, and throughout the holiday period, our team has been working tirelessly to first and foremost ensure our systems are secure and prevent further intrusions. Secondly, we have been working as part of a cross-sector group to implement processes to begin communication with affected practices and patients.

We acknowledge that this delay has been a cause for concern. We will make every effort to continue to work hard to provide you with accurate and reliable information as urgently as practicable, in consultation with various stakeholders.

Manage My Health welcomes the commissioning of a Ministry of Health review and will cooperate fully with this process. We hope the findings and recommendations of the review are not just helpful to us, but to the whole sector.

Legal action
To protect patient data and confidentiality, Manage My Health has today been granted injunction orders from the High Court preventing third parties from accessing any data posted as a result of the incident.

We have an international team monitoring known data leak websites and are prepared to issue takedown notices immediately if any information is posted.

A cyber-attack is criminal activity, and any unlawful use of private client information will be subject to legal action and takedown orders. Any ransom demand is a matter for NZ Police and Manage My Health will not be making any comment in this regard, as it is an ongoing investigation.

Direct communications beginning this week
We are commencing today, our communications to practices and will be continuing this process throughout the course of this week, until this notification process is complete. Alongside this, we will be providing regular updates via our website, as and when information becomes available and it is appropriate for us to share it.

For context, under the Privacy Act 2020 and the Health Information Privacy Code, the obligation to notify affected individuals sits with the agency that holds the information. Where health documents originate from multiple sources, there may be multiple data controllers with independent notification obligations. This requires coordination to ensure we meet our legal obligations.

Affected Patients
We have identified all patients whose documents may have been accessed in this incident.

Direct patient notification will commence this week. The exact timing requires coordination with Health New Zealand, GPNZ, and GP practices to ensure patients receive clear, consistent information and do not receive multiple or confusing notifications from different organisations about the same incident.

General Practices
We have commenced notifying practices from today. Each practice will receive access to a confidential list of their affected patients through our secure Provider Portal, along with guidance on supporting patients who contact them with questions.

This will enable general practices to prepare for patient enquiries before patients receive direct notification from us. GPs are often the first point of contact for concerned patients, and we want to ensure they have the information they need.

Patient support
We will start the patient communication process after practices have been notified. A dedicated 0800 helpline will be established for affected patients as soon as possible. Further details, including the phone number and operating hours, will be provided in our next update.

Independent forensic investigation
An independent forensic investigation by specialist cybersecurity consultants continues. As this is an ongoing investigation, we cannot currently comment on specific technical findings.

We share the pain suffered by Kiwis by this cyber-crime, and are committed to ensuring your data is safe and will work to restore the trust you have in us.

Contact
In the interim, if any patients or practices have any concerns or questions, please contact us directly via info@managemyhealth.co.nz

FAQs
For any further information, please refer to our frequently asked questions here: FAQs - Cyber Breach | Manage My Health

Our regular updates can be found here:

Trusted by over 1.85 million Kiwis and used by most health centres, Manage My Health is a secure health portal that empowers people to take charge of their

03/01/2026

MMH cyber breach update 3 January 2026

Further to our update issued on 2 January 2026 regarding the cyber security incident we were notified of on 30 December, Manage My Health is providing additional factual details and supporting information as independent forensic analysis continues to progress.

Independent forensic assurance

We have received independent confirmation from our forensic cyber security specialists that the current system environment is secure and operating as intended.

The investigation has identified that one module, Health Documents, within the app was compromised, not the whole app.
Manage My Health is commencing legal action to protect our clients data.

We now have the complete list of people whose documents may have been accessed and expect forensic confirmation of the documents effected in the coming days.

We know that 6-7% of the approximately 1.8 million registered users have been affected by this incident. We expect to start notifying those affected following confirmation of forensics and liaison with PHOs and GPs to ensure that individuals are getting the right information, in line with Privacy Act requirements, and are properly supported.

The forensic team is continuing work to confirm our analysis of the specific documents involved. Completion of this step will enable us to proceed with more targeted communications to affected parties, and we will start informing people directly from early next week.

Together with identifying everyone affected, Manage My Health has:

* Fixed the security gap: We've identified and closed the specific gaps that allowed unauthorised access. This fix has been independently tested and verified by external cybersecurity experts.
* Made log-ins more secure - We've added extra checks when people log in and limited how many times someone can try to access the system in a short time.
* Secured the files - All health documents have been re-secured and their storage has been strengthened.

For peace of mind, any Manage My Health user can reset their password or enable two-factor authentication (2FA) where available, including biometric measures, to add an additional layer of protection to their accounts.

Here is the link to instructions to enable the two-factor authentication (you need to be logged in to access the link): https://app.managemyhealth.co.nz/myaccount/two-step-verification

Supported Authenticator Apps:

• Google Authenticator
• Microsoft Authenticator

In addition, keep an eye out for anything unusual, such as medical bills or insurance claims you don’t recognise, or unexpected letters from healthcare providers. If you see anything that looks odd to you, contact the relevant provider immediately.

You can also report anything suspicious to the New Zealand Police via police.govt.nz and report any suspected scam calls or emails to CERT NZ via cert.govt.nz.

Coordinated communications with the sector

We are working closely with General Practice New Zealand (GPNZ) leadership and Health New Zealand to coordinate communications to practices and to support consistent, accurate messaging across the sector.

Dedicated support for practices and users
Manage My Health is urgently endeavoring to establish a dedicated helpline to support both practices and users by early next week. Support will be available via:

* An online helpdesk; and
* A dedicated 0800 support number (details to be published as soon as possible).

Manage My Health is working with independent cyber security specialists, the Privacy Commissioner, the New Zealand Police and Health New Zealand regarding the data breach.

Communications to affected practices, organisations, and patients are being prepared and will be issued once final verification steps are completed.

We appreciate the patience and cooperation of practices, patients, and partners. Our priority remains transparency, system security, and ensuring appropriate support is available while the investigation is finalised.

Manage My Health will provide a further update as soon as new information is available.

ManageMyHealth™ is a secure health portal that provides 24/7 access to your health records, video consultations, hospital letters, referrals, appointment bookings, repeat prescriptions, and direct messaging with your doctor

02/01/2026

Date: 2 January 2026
From: Manage My Health

MMH cyber breach update

Further to our update issued on 1 January 2026, Manage My Health is providing additional factual clarification as investigations continue.

We recognise the public interest in this matter and the importance of providing clear, accurate information while forensic work remains ongoing.

Timeline and notifications

Manage My Health became aware of the cyber security incident on 30 December 2025, following notification from a partner.

On becoming aware of the issue, our immediate priorities were to secure the platform, prevent any further unauthorised access, and preserve system evidence for forensic investigation. Independent cyber security and forensic specialists were engaged at that point.

The Office of the Privacy Commissioner was notified and we have remained in active contact with the Commissioner’s Office since that time.

Health New Zealand, New Zealand Police and other relevant organisations were also notified, and we are working closely with them to meet regulatory, sector, and legal obligations.

A public holding statement was published on the Manage My Health website on 1 January 2026, followed by further updates as additional verified information became available. We are still ascertaining the various parties affected in what is a complex investigation. We are endeavouring to provide information as it becomes available.

Scope of the incident

Independent forensic analysis is ongoing to validate the full scope of access and any data exfiltration.

Based on investigations to date, we believe that approximately seven per cent of our approximately 1.8 million registered patients may have been affected.

Our preliminary findings indicate that the unauthorised access was to a specific group of documents in the system.

Preliminary investigation reveals no evidence at this stage that the core patient database was accessed, nor any evidence of data modification or destruction within our system, nor any access to user credentials.

Attribution

Attribution remains a matter for law enforcement and forensic investigation, and we are cautious about drawing conclusions while that work continues.

What you can do

Manage My Health recommends that it is best practice to regularly update your password.

To ensure your online security, we strongly advise you read the guidelines provided by the Own Your Online at https://www.ownyouronline.govt.nz/personal/get-protected/

Manage My Health users can enable Mutli-Factor Authentication (MFA) using a supported authenticator app, providing an additional layer of account security.

Supported Authenticator Apps:

• Google Authenticator
• Microsoft Authenticator

Here is the link to instructions to enable the two-factor authentication (you need to be logged in to access the link) – https://app.managemyhealth.co.nz/myaccount/two-step-verification

Next steps

For more information, visit our FAQs page regarding the cyber breach here https://managemyhealth.co.nz/faqs-cyber-breach/

Our priority remains confirming with certainty which individuals and organisations are affected and contacting them directly with clear information and guidance.

We understand the anxiety incidents of this nature can cause, particularly where health information is involved. We appreciate the patience shown by patients, healthcare providers, and partners while this complex investigation continues and we will provide further updates as confirmed information becomes available.

Our next update is scheduled for Saturday 3 January at 3pm.

Sincerely
Vino Ramayah
CEO Manage My Health

Find the answers to the most frequently asked questions related to the recent Cyber Breach.

01/01/2026

Manage My Health update on cyber security incident

Manage My Health was notified yesterday of a cyber-security incident involving unauthorised access to its New Zealand application. Since we were alerted, our team has been working very hard to ensure that the application is secure.

We believe the incident has been contained, and we have engaged independent international forensic consultants to further verify the solution we have put in place and determine the extent of the data which is affected.

Based on our investigations to date, we believe between six and seven per cent of the approximately 1.8 million registered users may have been affected by this incident.

We have begun analysis to identify users affected. As you can appreciate, this is a complex exercise, and we expect to start notifying those affected within the next 48 hours.

The Office of the Privacy Commissioner has been notified and is working with us to meet our obligations under privacy legislation.

The New Zealand Police have been notified, and Manage My Health is engaging with Health New Zealand and other organisations to coordinate our response.

We recognise that any incident involving health information can cause anxiety and distress. People rightly place a high level of trust in systems that hold their health data, and we understand the concern this situation may create for patients, providers, and partners. We want to thank users and the sector for their patience while a complex investigation continues.

To support patients and providers, we will provide a detailed FAQ to help resolve their questions where possible. To ensure your online security, we strongly recommend you read the guidelines provided by the Own Your Online website https://www.ownyouronline.govt.nz/personal/get-protected/

Vino Ramayah, Chief Executive Officer of Manage My Health, says that Manage My Health takes its obligations to data security seriously.

“We understand how personal and sensitive health information is, and we recognise the stress an incident like this can cause. Our team is working hard to identify those affected, and to communicate directly and transparently,” he says.

Manage My Health will provide a further update at 3pm tomorrow (2 January 2026).

15/12/2025

Urgent care clinics deal with constant pressure at the front desk. Self-arrival tools take care of the basics so staff can focus on people

Learn how it works: https://e.managemyhealth.co.nz/p/7OEW-22J/cut-waiting-times-and-free-your-team-with-self-arrival

12/12/2025

Less noise at reception. Fewer repeated questions. Better data. Self-arrival is becoming part of urgent care operations.

Read full article: https://e.managemyhealth.co.nz/p/7OEW-22J/cut-waiting-times-and-free-your-team-with-self-arrival

11/12/2025

For GPs: When the patient completes the form, it pre-populates their ACC 45 form in Medtech, so the GP only needs to review and submit, rather than typing it out, giving the patient more time during the consult.

✅ Reduce reception admin time
✅ Reduce GP admin time
✅ Enhance/digitise the patient experience
✅ Reducing errors from reading hand-written forms

Read full article: https://e.managemyhealth.co.nz/p/7OEW-22J/cut-waiting-times-and-free-your-team-with-self-arrival

10/12/2025

Clearer patient flow starts at check-in. Self-arrival helps clinics move faster.

🔸 Cut waiting times
🔸 Reduce front-desk queues
🔸 Contactless Self Check-In

For more information, visit our page below 👇
https://e.managemyhealth.co.nz/p/7OEW-22J/cut-waiting-times-and-free-your-team-with-self-arrival