top of page

The Manage My Health Cyber Security Incident




The following is a summary of what has been published online regarding the late December 2025 cyber breach of the Manage My Health portal. Some of the sources reported have since taken down their content. We have endeavoured to be as factual as possible and will update this post as new information comes to light.


Summary


In late December 2025, Manage My Health (MMH), New Zealand’s largest patient portal, was subject to a cyber-extortion incident. A threat actor operating under the alias “Kazu” exfiltrated approximately 108 gigabytes of sensitive health-related data, affecting an estimated 126,000 individuals.


The core patient records database remains intact. However, a discrete component of the platform (used to store unstructured health documents) was accessed and its contents removed.


Below we outline how the breach occurred, the nature of the data exposed, and what the incident reveals about the platform’s broader security posture.


How the breach occurred


This was not a sophisticated compromise of MMH’s primary systems. The attackers gained access using valid user credentials and then exploited an access control flaw in an application programming interface (API) associated with the “Health Documents” module.


In effect, the attacker entered the system legitimately but was then able to bypass authorisation checks, allowing access to documents belonging to other users. This is a well-understood class of vulnerability.


The "Health Documents" module


It is important to distinguish between MMH’s core “Health Records” and its “Health Documents” functionality.


The structured health records, such as appointments, medications, and standard GP notes, were not compromised. The breach was confined to the “Health Documents” module, which acts as a file repository for patient-uploaded documents and certain forms of clinical correspondence.


What data was exposed


The exfiltrated material consists of approximately 428,337 individual files. This was not a database extract in tabular form, but a large collection of standalone documents.


Types of information involved


  • Clinical correspondence: Including hospital discharge summaries, specialist letters, and laboratory results.

  • User-uploaded content: Files uploaded directly by patients, ranging from images of medical conditions to scanned identity documents such as passports.

  • Legacy data: Documents relating to former users who had left their GP practice years earlier. MMH has confirmed that patient data is retained unless an account is explicitly closed by the user, even after leaving a practice.


Regional concentration


The impact has been disproportionately felt in Northland. Health NZ estimates that more than 70 percent of affected users (approximately 86,000 people) are based in the region.


This appears to reflect a regional implementation choice: Northland was the only area where Health NZ used MMH to deliver hospital discharge summaries and outpatient letters directly to patients via the platform.


Security infrastructure observations


Independent analysis conducted after the breach identified weaknesses in MMH’s broader security configuration, separate from the specific API vulnerability that enabled the data access.


Email authentication configuration and DNS controls


As of early January 2026, MMH’s Domain-based Message Authentication, Reporting, and Conformance (DMARC) policy places the domain in monitoring mode only and does not actively prevent unauthorised parties from sending emails that appear to come from the managemyhealth.co.nz domain. It was also reported that some of the platform’s basic security protections were not up to current standards.


In simple terms, this meant emails could be more easily faked to look like they came from Manage My Health, increasing the risk of scam or phishing messages reaching patients. In addition, extra safeguards that help ensure people are taken to the real website, rather than a convincing fake, were not switched on, making it easier for attackers to potentially mislead users online, although there is no report that this is what actually happened.


Remediation actions


Manage My Health says it has fixed the specific weakness that allowed the data to be accessed, and that this fix has been checked by independent security experts. The company has also added an extra, optional layer of login protection, which requires users to confirm their identity with a second step, such as a code sent to their phone, when signing in. This is known as multi-factor authentication (MFA) or two-factor authentication (2FA).


The "Kazu" group


The breach has been attributed to a commercially motivated “threat actor” or group using the alias “Kazu.” A ransom demand of approximately NZ$100,000 was issued, with the threat of public data release if payment was not made.


Kazu has been linked to previous international cyber-extortion activity, suggesting opportunistic financial motivation rather than ideological or political intent.


Current responses and practical guidance


Government review


The Minister of Health, Simeon Brown, has commissioned an independent review by the Ministry of Health to examine both the cause of the breach and the adequacy of the protections applied to patient data.


Advice for users


  • Confirm your status: Log in directly to the MMH website (desktop computer or laptop recommended rather than phone) and check for an on-screen notification banner.

  • Change passwords: Update your MMH password immediately, particularly if it is reused elsewhere.

  • Be alert to phishing: Treat unsolicited emails claiming to be from MMH, Health NZ, or your GP with caution. Avoid clicking links and verify communications through official channels.


More information


RNZ has provided good coverage of the incident including a full summary of the timeline and what we know so far.


Many other sources have been taken down since we first looked at them. We’re assuming because there may be concerns that too much coverage of the technical details can only serve to aid the attackers. There could also be concerns about early reports being factually inaccurate or introducing liability for publishers.


Manage My Health is regularly updating on the incident here: News & Updates related to Cyber Breach


Office of the Privacy Commissioner has good information on rights and responsibilities. This site doesn’t like direct links to articles, so go to Office of the Privacy Commissioner and search for Manage My Health.


Other reports




CIO Studio provides independent digital strategy and leadership for New Zealand's health, NGO, and community organisations. If you want to talk to an expert about mitigating your cyber security risk, get in touch for a no obligation conversation.

Comments

Sign up for our monthly Digital Digest

Get industry updates, tech news, and CIO Studio blogs free to your inbox!

bottom of page