multiple reports of the website crashing<\/a> as patients try to find out if they’ve been affected.<\/p>\nAngus Chambers from the General Practice Owners Association was also unimpressed with how long it was taking to Manage My Health to contact patients.<\/p>\n
Those who had not yet been told their data had been breached had been left wondering whether it had, he said.<\/p>\n
![\"GenPro](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2025\/10\/4KKINDH_GenPro_jpg\")
<\/p>\n
\nAngus Chambers from the General Practice Owners Association.
\nPhoto: Supplied\n<\/p>\n
Manage My Health’s latest update said “direct notifications to the first 50 percent of patients affected” had commenced.<\/p>\n
It did not answer a request from RNZ to clarify that statement.<\/p>\n
Notifications were being sent by email to addresses affected patients used to register their account.<\/p>\n
An Auckland patient, Barbara, told RNZ she was disturbed after Manage My Health told her that her data had been breached after telling her two days earlier it had not.<\/p>\n
“I got an e-mail saying that my details hadn’t been impacted by the hacking, and that was fine, I thought ‘oh well, good’,” she said.<\/p>\n
“And then I got another email to say well actually, yes I have unfortunately.”<\/p>\n
Barbara said she was directed to go online to immediately change her password.<\/p>\n
“I got part way through and then there was a notification saying the website was down, I presume everybody who’s just been notified was trying to change their password immediately and it was overloaded,” she said.<\/p>\n
Barbara was now left trying to figure out what her data being breached meant for her, she said.<\/p>\n
“I can see for some people that have come forward, like the people who have suffered from abuse and things like that, you definitely don’t want that information out there.<\/p>\n
“But what else is there? And that’s what’s worrying me.”<\/p>\n
Another patient who RNZ has agreed to not name said Manage My Health should have known that lots of anxious patients would flood its website.<\/p>\n
“They are reporting problems with the platform on the platform that is having problems,” she said.<\/p>\n
Disability advocate Blake Forbes, meanwhile, said it was unacceptable that many people were still in the dark over a week after the cyber attack.<\/p>\n
“For me it’s causing, from a personal perspective, and I know a lot of friends are like this as well, it’s causing me a lot of anxiety, their GPs don’t even know what’s going on.”<\/p>\n
![\"Blake](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2026\/01\/4K9UEFE_250328_Blake_Forbes_Gentle_1_jpg.jpeg\")
<\/p>\n
\nDisability advocate Blake Forbes.
\nPhoto: RNZ \/ Samuel Rillstone\n<\/p>\n
Dead patients among those with records breached<\/p>\n
Manage My Health announced it had appointed an honorary clinical advisor in the wake of the breach, Emeritus Professor Murray Tilyard.<\/p>\n
He told RNZ the breach was significant, but varied from practice to practice.<\/p>\n
“So I’m aware of a clinical network who have over 100,000 enrolled patients, and 99.6 percent of those patients’ records have not been breached,” he said.<\/p>\n
“Now, that doesn’t mean that other practice networks or practices don’t have a much higher proportion.”<\/p>\n
Tilyard expanded on what he said were three categories within the breach relating to three years of data between 2017 and 2019.<\/p>\n
The first was Northland hospital discharge summaries, he said.<\/p>\n
“So these only affect patients who were resident in that Northland area in those years, 2017 to 2019. We now know that many of them have shifted.”<\/p>\n
The second category was material uploaded by patients themselves.<\/p>\n
“It could be, for instance, I’ve notified via the portal that I’ve changed my address. It could be that I’ve actually uplifted my home blood pressure recording, or my weight.<\/p>\n
“So these are patient-generated documents.”<\/p>\n
The third was referral documents.<\/p>\n
“So I’m interested, once I’m briefed, to understand the mix of those,” he said.<\/p>\n
“Because that’s actually important to be able to tell the patients whose data has been breached what has actually been taken because some data, I would suggest both you and I would feel is more sensitive than other data.”<\/p>\n
Tilyard said he did not underestimate how patients would be feeling.<\/p>\n
“I mean, I go back to when I was very young and living at home in Wellington and we came back from holiday to find that people had broken the house and lived there for a week. My mother was devastated, she wanted to leave,” he said.<\/p>\n
“The house was tainted, her privacy was tainted.”<\/p>\n
Tilyard said his role would also include helping practices identify patients who were potentially vulnerable and may need more support.<\/p>\n
He said the breaches did not just affect patients.<\/p>\n
“I’m aware that some of the patients who start have been breached are deceased, so my strong view is that the practices must identify, obviously, those who are deceased.”<\/p>\n
He said next of kin must be identified and contacted because they themselves may be vulnerable.<\/p>\n
“In New Zealand there are 1022 individual general practices, so we’re mobilising.”<\/p>\n
Tilyard said he knew Manage My Health chief executive Vino Ramayah and offered his help.<\/p>\n
![\"Manage](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2026\/01\/1767781329_31_4JV7VPG_image_png.jpeg\")
<\/p>\n
\nManage My Health CEO Vino Ramayah.
\nPhoto: SCREENSHOT \/ RNZ\n<\/p>\n
Manage My Health response ‘unacceptable’, site still has flaws<\/p>\n
Vimal Kumar, a senior lecturer at Waikato University’s Cyber Security Lab, said it had taken too long for Manage My Health to contact affected patients.<\/p>\n
He described the security breach as “a pretty major one”.<\/p>\n
“The company was made aware of this on 30th of December and they are reaching out to their users, people who have been affected now,” he said.<\/p>\n
“It’s shocking, and people are worried about the safety of their data and their own well-being.<\/p>\n
“And then to have to wait for nine days to get any information from the organisation is shocking, to be honest.”<\/p>\n
Kumar said other aspects of Manage My Health gave an indication of its security.<\/p>\n
“There’s something called DMARC (Domain-based Message Authentication, Reporting, and Conformance) which has not been set up properly.”<\/p>\n
He said this was something that was easy to configure.<\/p>\n
“Now, this particular hack is not related to DMARC, but that sort of gives you an idea of the cybersecurity posture of the organisation.<\/p>\n
“If the DMARC which is fairly easy to set up has not been set up, then what other things were not being done properly?”<\/p>\n
The key facts according to Manage My Health<\/p>\n
The cyber incident was limited to 6-7 percent of 1.8 million registered users, within the “My Health Documents” module only.<\/p>\n
The data relates to a range of medical practices, including:<\/p>\n
Approximately 45 Northland-based GP practices;
\nClinical discharge summaries and historical clinical referral records in the Northland region (data that is between six and eight years old)
\nApproximately 355 “referral-originating” GP practices across a number of New Zealand regions
\nPersonal health information uploaded by patients<\/p>\n
Sign up for Ng\u0101 Pitopito K\u014drero<\/a>, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.<\/p>\n","protected":false},"excerpt":{"rendered":"Photo: RNZ \/ Finn Blackwell New ransom deadline arrives Deceased patients among those to have data breached Manage…\n","protected":false},"author":2,"featured_media":223815,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[48,47,111,43,139,69,49,46,44,45],"class_list":{"0":"post-223814","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-new-zealand","8":"tag-audio","9":"tag-current-affairs","10":"tag-new-zealand","11":"tag-news","12":"tag-newzealand","13":"tag-nz","14":"tag-podcasts","15":"tag-public-radio","16":"tag-radio-new-zealand","17":"tag-rnz"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/223814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=223814"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/223814\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/223815"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=223814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=223814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=223814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"ManageMyHealth,](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2026\/01\/4JV8FCI_Media_2_jpg.jpeg\")
<\/p>\n![\"Royal](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2026\/01\/4L6PHXP_Dr_Luke_Bradford_1_png.jpeg\")
<\/p>\n