ManageMyHealth investigates breach of New Zealand patient portal
Learn More
ManageMyHealth, a health portal in New Zealand, reports that attackers broke into its systems. The platform allows patients to view their medical records and communicate with their doctors. CEO Vino Ramayah said the company is now investigating the unauthorized access to determine the full scope of the incident.
The company is working with the police and outside security experts to investigate the root cause ManageMyHealth claims they prioritize data safety, but they have not yet shared how the attackers got in or how long they had access to the network.
The exposed data inlcudes:
- Personal medical records
- Patient identity information
- Clinician contact details
- Account login data
The nature of the attack and the the number of affected individuals are not disclosed. The company is still investigating the full extent of the data theft. Similar attacks often exploit credential stuffing or vulnerabilities in remote access tools.
They advise users to stay alert for phishing attempts and to reset their passwords on the platform. Further updates will be shared as the investigation continues.
Update: Vino Ramayah provided the NZ Herald with extra details details:
“Based on our investigations to date, we believe between 6 and 7% of the approximately 1.8 million registered users may have been affected by this incident.”
That comes out to between 108,000 and 126,000 affected individuals.
As of 4th of January 2026, Manage My Health reports they have identified general practices whose patients had data breached in the incident, but it is not yet clear when all those patients will be told.
Health NZ national director of planning, funding and outcomes Jason Power said: "We expect MMH to share the timeframe for notifications by Tuesday."
As of 22nd of January 2026, Manage My Health reports that hackers may be attempting to contact its customers and might be sending spam or phishing emails that impersonate the company: "We're also aware that secondary actors may impersonate MMH and send spam or phishing emails to prompt engagement. These communications are not from MMH. We're investigating steps to limit this activity and have included guidance below on how to protect yourself below,"
