Manage My Health Limited

Hackers using stolen patient credentials accessed the 'My Health Documents' section of New Zealand's largest patient portal, Manage My Health, copying documents from roughly 126,000-127,000 patient accounts (later revised down from an initial estimate of 126,000+); a group calling itself 'Kazu' claimed 108GB across 428,337 files and demanded a US$60,000 ransom. New Zealand's Privacy Commissioner opened a statutory inquiry under the Privacy Act 2020 and found in its Phase One report that MMH had made multi-factor authentication optional rather than mandatory, had insufficient access controls and breach-detection capability (Health NZ, not MMH, first alerted the company), and had failed to remediate access-control and application-security risks flagged in prior security testing -- concluding MMH breached Rule 5 of the Health Information Privacy Code.