Canopy Health Confirms Six-Month Delay in Disclosing Major Data Breach Canopy Health has acknowledged a significant cyber intrusion that went undisclosed to patients for six months, sparking outrage among those affected. The breach was first detected on 18 July 2025, when the organization identified unauthorized access to its internal administrative systems. A subsequent forensic investigation revealed that hackers likely copied data from one of its servers, though the full scope remains under review. Patients expressed frustration over the delayed notification, with some learning of the incident only after receiving an email this week. One anonymous woman, who used Canopy Health’s services for mammograms under BreastScreen Aotearoa, criticized the lack of transparency, stating that the six-month delay was "completely unacceptable." While Canopy Health claimed no credit card or identity documents were compromised, its website later acknowledged that hackers may have accessed "a small number of bank account numbers" provided for payments or refunds. Another affected Auckland resident, who received a breach notification in mid-December, questioned the company’s assurance that identity risks were minimal. She warned that compromised data could have serious consequences, particularly for her profession. In response, Canopy Health stated it was directly notifying impacted individuals and advised them to contact their banks for precautionary measures. The breach occurs amid broader concerns about healthcare data security, following a separate ransomware attack on Manage My Health in late December, which affected roughly 125,000 users, primarily in Northland. Both incidents have intensified scrutiny over transparency, accountability, and patient data protection in New Zealand’s healthcare sector. Investigations into the Canopy Health breach remain ongoing.

Cybersecurity Breach at Canopy Health Exposes Patient Data, Delayed Notifications Raise Concerns Canopy Health, Australia’s largest private medical oncology provider, disclosed a cyberattack on July 18, 2025, after detecting unauthorized access to an administrative server. A forensic review confirmed that data may have been copied, though the incident was contained. The breach potentially exposed a limited number of bank account details provided for payments or refunds, though the company stated the risk of misuse was low. Despite the July discovery, some patients—including one whose wife received a notification letter on December 12—reported learning of the breach months later. This incident follows another major health data breach involving ManageMyHealth, a patient data platform. In late December, the company confirmed unauthorized access affecting 6–7% of its 1.8 million users. Over 125,000 patients were impacted, with more than 80,000 in Northland, where Health NZ relies on the platform for sharing sensitive medical records, including discharge summaries and clinic letters. ManageMyHealth stated that independent IT experts had verified fixes to the vulnerabilities, and over half of affected users had been notified by mid-January. Both breaches highlight ongoing risks to healthcare data security and the challenges of timely breach disclosures. Investigations remain ongoing.