![\"ManageMyHealth,](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2026\/01\/4JV8FCI_Media_2_jpg.jpeg\")
<\/p>\n<\/p>\n
\nThe company has apologised for the breach and hopes to have contacted affected patients by early next week.
\nPhoto: RNZ \/ Finn Blackwell\n<\/p>\n
Patients whose health records have been stolen in the Manage My Health ransomware attack are struggling to get any information, with the website repeatedly crashing and the 0800 number overloaded.<\/p>\n
Andrea*, who lives in Wellington, said she received an email on Friday, telling her that she had been “impacted” and to log on to Manage My Health for more details.<\/p>\n
“Except I can’t log in, as it’s ‘temporarily unavailable’,” she said. “I called the helpline included and was apparently No. 2 in the queue.<\/p>\n
“I waited and waited, and had several more ‘Sorry to keep you waiting’ messages, but then at 11 minutes, the call was cut off.<\/p>\n
“I called back and there was an automated message saying, ‘Due to the high volume of queries, we are unable to take your call’.”<\/p>\n
Andrea tried a couple of times more over the morning, before giving up.<\/p>\n
She said she had been prepared to give Manage My Health “the benefit of the doubt” until now.<\/p>\n
“First of all, I thought, ‘Well, no news is good news’, but that was not the case, because it turns out I am impacted. Then I was, like, ‘OK, I’ll trust the process’, but I no longer trust the process.<\/p>\n
“I naively gave them the benefit of the doubt, but now I’m just angry.”<\/p>\n
She messaged the company and planned to lay a formal complaint with the Privacy Commissioner.<\/p>\n
Patient health portal Manage My Health said there’s no scenario where they can instantly notify those affected by a data breach.<\/p>\n
In a statement released this evening, the company said it understood how patients were feeling, but the notification process could not be simplified.<\/p>\n
“We understand it is distressing and appreciate the frustration at the timing of communications. However, this is a complex exercise which unfortunately cannot be simplified due to the separate cohorts of patients affected which have to be dealt with in different ways.”<\/p>\n
Mixed messages<\/p>\n
Another patient, Nel*, said she received two emails from Manage My Health on Friday, advising that her health documents had been impacted in the data breach “and offering their sincere apologies”.<\/p>\n
“I was directed to the website to log on for more information about the health data that was impacted,” she said. “When I logged on, I was advised I was my personal health data was not affected by the breach.<\/p>\n
“It is very hard to have any faith in Manage My Health to ‘manage’ this situation and protect my health information.”<\/p>\n
Where were checks and balances, patients ask<\/p>\n
Lou* is angry with the criminals behind the ransomware attack – but even more furious with Manage My Health’s “arguably criminal negligence” and poor communication.<\/p>\n
“I know for a fact, based on the limited information provided by Manage My Health, that some of my most sensitive information is now in the hands of someone unknown, and there is now a crescendoed risk of me being targeted for scams and potential ID theft.<\/p>\n
“The potential documents now hanging in the balance contain a lifetime’s details of health records… hugely vulnerable details of my worst moments, healthwise.<\/p>\n
“Beyond that, we have not yet been informed of further data now made available as ammunition.”<\/p>\n
It was hard to understand how a private company had been allowed to store highly sensitive information without basic safeguards, Lou said.<\/p>\n
Overseas users locked out<\/p>\n
A New Zealander currently based overseas said Manage My Health had blocked her ability to secure her account, ironically, for “security reasons”.<\/p>\n
The email from Manage My Health informing her that her account had been affected listed three recommended security steps – changing her password, enabling multi-factor authentication and “stay[ing] alert for any unusual account activity”.<\/p>\n
“However, because I am overseas, MMH has blocked my ability to access my account.<\/p>\n
“The email I received from MMH suggests that this is because of recent steps MMH has taken to tighten security – ‘We’ve added extra checks when people log in and limited how many times someone can try to access the system in a short time’.<\/p>\n
“However, as a legitimate user of the MMH system who just happens to be overseas right now, I find myself unable to implement any of the recommended security steps or access any of the information in my MMH account.”<\/p>\n
She said she was frustrated with the time Manage My Health had taken to make contact and the additional barriers.<\/p>\n
“This is a frustrating over-correction. Not only does it prevent me from taking the steps necessary to secure my information, it also appears to be another privacy breach.<\/p>\n
“I can no longer access my own personal health information, without sharing my login details with somebody who is located in NZ, which I imagine is also a breach of MMH’s terms.”<\/p>\n
Blank emails<\/p>\n
Grant* said he received an email on Friday morning headed “Important: Information About Your Manage My Health Account”, but the email was completely blank.<\/p>\n
“I don’t know if my data has been compromised or not.<\/p>\n
“My wife opened it with the mobile phone and had the information that my details had been accessed, but trying on the desktop, there’s nothing showing on the email.<\/p>\n
Gemma* said she was also told that her account had been impacted, with a “summary” of the incident, but could not get through on the 0800 number provided.<\/p>\n
“I called this morning and was 13th in the queue, before it cut me off, and it’s now overloaded and tells you to try again in a hour.<\/p>\n
“Needless to say, I still haven’t been able to get through. It does go onto tell you the steps that have been taken.<\/p>\n
“The email also says you have the right to complain to the Office of the Privacy Commissioner, but fails to tell you that the OPC won’t accept a complaint, until you have complained to the provider first.”<\/p>\n
Manage My Health has apologised for the cybersecurity breach and said it hoped to have contacted all affected patients by early next week.<\/p>\n
Manage My Health said it was aware of some users facing technical difficulties like receiving emails, accessing the patient portal and viewing documents in their account.<\/p>\n
It directed those people to contact them using the existing methods.<\/p>\n
The company said its focus was on direct communications with those affected by the breach.<\/p>\n
“MMH would like to reiterate its sincere apology to those impacted by this criminal cyber breach,” it said.<\/p>\n
It said all remaining patients affected by the breach were expected to be notified by early next week.<\/p>\n
“More than half of all impacted patients have now received a notification email.”<\/p>\n
Manage My Health said it was unable to provide any comment on the hacker, Kazu, or any ransom demand.<\/p>\n
*names changed for privacy reasons<\/p>\n