What Happened
In late December 2025, ManageMyHealth — New Zealand's largest personal health portal — suffered a significant data breach. Attackers exfiltrated records relating to approximately 127,000 individuals and issued a ransom demand of $60,000, threatening to release over 400,000 documents if payment was not made.
The breach was described by the NZ Privacy Commissioner as one of the country's most significant cybersecurity incidents. RNZ reported the attackers accessed sensitive health records, appointment history, and personal contact information. The government launched a review into the adequacy of security protections and whether regulatory requirements were sufficient.
This is not a story that only affects healthcare organisations. Any NZ business that stores personal information — customer records, employee data, supplier contacts — faces equivalent exposure.
Why the Ransom Demand Is Not the Worst Part
The $60,000 ransom demand attracted headlines. The actual cost of the breach is orders of magnitude higher.
Consider what a breach of this scale triggers:
- Privacy Commissioner investigation: Under the Privacy Act 2020, organisations must notify the Privacy Commissioner of a notifiable privacy breach without undue delay. A breach of 127,000 records is unambiguously notifiable. The Commissioner can require organisations to undertake remediation, change practices, or face enforcement action.
- Individual notification: Affected individuals must also be notified — 127,000 notification letters, emails, and support calls.
- Regulatory review: The government response to the ManageMyHealth breach included a direct review of security standards. Organisations in regulated sectors can expect increased scrutiny.
- Reputational damage: ManageMyHealth's core value proposition is that it stores sensitive health data securely. That proposition took significant damage.
For an SME, the reputational and regulatory cost of a breach of even 1,000 customer records can exceed the direct costs of remediation. See our analysis of the real cost of a data breach for NZ SMEs.
The Attack Vector: What We Know and What It Implies
Full technical details of the ManageMyHealth breach have not been publicly disclosed. However, the pattern — external access, bulk data exfiltration, ransom demand — is consistent with attacks CERT NZ has documented repeatedly across NZ organisations. The most common entry points are:
- Credential compromise: Phishing or credential stuffing attacks targeting accounts with access to systems storing personal data
- Unpatched external-facing systems: Web applications, VPNs, and remote access tools with known vulnerabilities
- Third-party access: Vendors or suppliers with access to the environment who are compromised upstream
For NZ SMEs, the relevant question is not "could this happen to a health portal" — it is "which of these entry points exist in our environment right now?"
What NZ Businesses Must Do Differently
1. Know where your personal data actually lives
Many businesses cannot accurately answer the question: where is our customer and employee data stored, and who has access to it? This is your starting point. Without a data map, you cannot protect what you do not know exists.
2. Apply MFA to every system that holds personal data
Credential-based attacks work because passwords alone are insufficient. Multi-factor authentication on every external-facing system — email, CRM, cloud storage, accounting software — eliminates the most common attack vector. If your team uses SMS-based MFA, understand its limitations; app-based MFA (Microsoft Authenticator, Google Authenticator) is significantly more resistant to interception.
3. Patch external-facing systems within 48 hours of critical vulnerabilities
Ransomware groups and data extortion attackers actively scan for known vulnerabilities on external-facing systems. Critical patches should be applied within 48 hours. If that is not operationally possible, the system should be taken offline until patching is complete.
4. Test your backup and recovery process
The ManageMyHealth attackers threatened to release data — not just encrypt it. Backups do not protect you from data exfiltration and extortion. But they do protect you from ransomware that encrypts your systems. Verify that your backups are working, are stored offline or in an immutable state, and that you can actually restore from them in a realistic timeframe.
5. Have a breach response plan before you need it
CERT NZ guidance is clear: organisations that respond to incidents without a pre-established plan make worse decisions under pressure. At minimum, document who decides whether to pay a ransom (the answer is usually no), who notifies the Privacy Commissioner, who notifies affected individuals, and who manages external communications.
The Regulatory Trajectory
The ManageMyHealth breach accelerated government attention on baseline cybersecurity standards. New Zealand's Cyber Security Strategy 2026–2030 and the forthcoming Cyber Security and Resilience Bill signal that mandatory security requirements are moving in the direction of broader application — not just critical infrastructure.
For NZ SMEs, waiting for legislation to compel action is a poor risk calculation. The regulatory and reputational cost of a breach significantly exceeds the cost of the controls that would have prevented it.
SecureAZ helps NZ SMEs implement baseline security controls, phishing awareness training, and incident response planning — without requiring an in-house security team.