![\"No](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2026\/01\/4O5PEE9_image_crop_44599.jpeg\")
<\/p>\n<\/p>\n
\nPhoto: 123RF\n<\/p>\n
A leading private provider doing breast cancer diagnosis and treatment took six months to notify some patients or the public of a major cyber attack on its systems.<\/p>\n
In an update on its website this week, Canopy Health – the largest private medical oncology provider in the country – said on 18 July 2025, it identified that an unknown person “temporarily obtained unauthorised access” to a part of its systems used by its administration team.<\/p>\n
“Following a thorough forensic review by our cybersecurity experts, we have been advised that unauthorised access to one of our servers likely occurred, and some data may have been copied.”<\/p>\n
The company, which runs 24 diagnostic clinics, eight oncology clinics, two private breast surgical centres and a drug compounding business, said the incident had been “contained” and the investigation was ongoing.<\/p>\n
Have you been affected? Share you stories with us at: iwitness@rnz.co.nz<\/p>\n
Under its Q&A section, Canopy noted the hacker “may have accessed a small number of bank account numbers, which had been provided to Canopy for payment or refund purposes”.<\/p>\n
“We are directly notifying potentially affected individuals.<\/p>\n
“It is unlikely the threat actor can take significant action with these details, as sensitive bank account information is highly protected.<\/p>\n
However, if you are concerned, please contact your bank.”<\/p>\n
One man – whose wife received a letter from Canopy Healthcare on 12 December to inform her of the “cyber event” – said it was the first they had heard of the breach.<\/p>\n
Canopy Healthcare has been approached for comment.<\/p>\n
Second health data incident<\/p>\n
In late December, another provider, Manage My Health, confirmed it had identified a security incident<\/a> involving “unauthorised access” to its platform.<\/p>\n It believed between 6 and 7 percent of the approximately 1.8 million registered users may have been affected.<\/p>\n On Friday, the company said more than half of all impacted patients had now received a notification email, and all patients who were not affected could also see that in their ManageMyHealth app.<\/p>\n More than 80,000 of the 125,000 patients affected by the ransomware attack are based in Northland<\/a> – the only region where Health NZ itself uses Manage My Health to share information with patients, including hospital discharge summaries, outpatient clinic letters and referral notifications.<\/p>\n The operators of compromised patient data app ManageMyHealth say they have received “independent confirmation” from IT experts the flaws in its code have been fixed.<\/a><\/p>\n