FlagThis

Abstract

On January 1, 2026, Manage My Health Limited (MMH) notified the Office of the Privacy Commissioner (OPC) that threat actors had stolen large amounts of health information from its patient health portal. The breach involved the use of stolen patient credentials to access and extract documents from thousands of other patient accounts, affecting 99,416 individuals, primarily in the Northland region of New Zealand. This Phase 1 report examines whether MMH and Health New Zealand (Health NZ) maintained reasonable security safeguards as required by the Health Information Privacy Code 2020.