Manage My Health Data Breach Exposes Clinical Records of Northland Patients A cybersecurity breach at Manage My Health, a New Zealand-based patient portal, has compromised historical clinical referral records dating from 2017 to 2019, affecting an undisclosed number of general practices and patients in the Northland region. The company has not publicly identified which GP clinics were impacted, leaving practices and patients seeking clarity. Key Details: - Who: Manage My Health, a digital health platform used by general practices, confirmed the breach but has not yet fully identified all affected users. The Privacy Commissioner has stated the company is responsible for direct notifications and support. - What: Stolen data includes historical clinical records, though the exact scope—such as patient numbers and specific information exposed—remains unclear. Some practices report fluctuating or inconsistent details in breach reports. - When: The breach occurred just before the new year, with an urgent review ordered by Health Minister Simeon Brown. A ransom deadline, initially set for January 15, has since been extended. - Where: The incident primarily impacts Northland-based general practices, though the full extent of affected clinics is still under investigation. Some practices, like Ngāti Hine Health Trust, proactively contacted the small number of their patients registered with the portal. - Why: The hacker, identified as Kazu, claims to be negotiating a ransom payment. A High Court injunction was granted to prevent further dissemination of the stolen data, though enforcement is limited outside New Zealand’s jurisdiction. Impact on Practices and Patients: - Paihia Medical Services reported over half of its 5,100 patients are registered with Manage My Health, with the clinic awaiting confirmation on how many were affected. - Kensington Health described the situation as chaotic, citing poor communication from Manage My Health and shifting breach reports. The practice has since migrated to a new system but retains historical data unless patients manually cancel their accounts. - Some clinics, including an unnamed Whangārei medical centre, opted not to comment publicly to avoid alarming patients amid ongoing uncertainty. - Ngāti Hine Health Trust took a proactive approach, personally contacting affected patients—many of whom were vulnerable individuals—to assess harm and offer support. - Mahitahi Hauora, Northland’s largest primary health organization, is coordinating a national response to ensure consistency across impacted practices. Ongoing Developments: Manage My Health has emphasized accuracy in its investigation, prioritizing data protection and direct communication with affected users. Meanwhile, the hacker’s Telegram account, which previously shared details of the breach, has had all related posts removed following the injunction. The company continues to work with authorities to mitigate the fallout.