Full Breakdown
Privacy Commissioner Orders Health New Zealand and Manage My Health to Remedy 2025 Data Breach
By Drooid · · How we work
Data Breach and Commissioner Action
In December 2025 the patient-portal service Manage My Health was hacked, exposing medical records for nearly 100,000 individuals. The breach prompted an investigation by the Privacy Commissioner, who concluded in May that Health New Zealand and Manage My Health “failed in their responsibilities” by lacking adequate security controls. As a result, the Commissioner issued a compliance order requiring the agencies to meet health-privacy standards by next year.
Background on the Portal and Oversight Body
Manage My Health operates as the primary online portal for patients to access health information under the auspices of Health New Zealand, the government agency responsible for public health services. The Privacy Commissioner, an independent regulator, enforces the Health Information Privacy Code and can require remedial action when entities do not protect personal health data.
Scope of the Breach
The cyber-attack resulted in the theft of medical files for almost 100,000 people, with roughly 90 % of those individuals residing in the Northland region. The scale of the breach was described as “massive” by the Commissioner’s findings, indicating a significant failure of data-security measures across the portal’s infrastructure.
Official Response and Compliance Deadline
Health New Zealand and Manage My Health have acknowledged the Commissioner’s findings and indicated they will implement the required security upgrades. The compliance deadline set by the Commissioner extends to the end of the following calendar year, giving the organizations time to overhaul technical safeguards, revise privacy policies, and conduct staff training to meet the mandated standards.
Next Steps
The agencies must submit a remediation plan to the Commissioner and demonstrate that new security controls are operational before the deadline. Ongoing monitoring will be required to ensure continued compliance, and any further lapses could trigger additional enforcement actions.