New Zealand Health Sector Hit by Another Major Privacy Breach as Cybersecurity Reforms Gain Momentum On February 22, MediMap a private portal used by aged-care homes, hospices, disability services, and community health providers to manage prescriptions and medication records was taken offline after an unauthorized actor tampered with patient data. Investigations revealed alterations to sensitive fields, including names, birthdates, prescriber details, care locations, and resident status, with some living patients incorrectly marked as "deceased." The breach follows a string of high-profile incidents in New Zealand’s health sector, including the 2025 Manage My Health breach, which exposed hundreds of thousands of medical documents. Together, these events highlight systemic cybersecurity vulnerabilities in health tech, raising concerns about vendor accountability, regulatory gaps, and the protection of sensitive health data. Key issues emerging from the breach include: - Lack of baseline safeguards: Experts argue that mandatory controls such as multifactor authentication, encryption, independent audits, and incident response obligations should be enforced for systems handling health data. - Confusion over accountability: Health agencies, including Health NZ, have incorrectly shifted responsibility to third-party vendors like MediMap, despite end-users bearing ultimate accountability for due diligence. - Regulatory reform: The breach has intensified calls to strengthen New Zealand’s Privacy Act 2020. On February 27, the government released its Cyber Security Strategy 2026-2030 and Action Plan 2026-2027, signaling potential reforms, including: - A civil pecuniary penalty regime for privacy violations. - A new offense targeting unauthorized access, possession, or dissemination of illegally obtained personal data. The incident underscores the need for clearer statutory requirements, contractual obligations, and governance practices to treat health data as critical infrastructure. Without these changes, the sector risks repeating the same failures one breach at a time.

New Zealand Faces Major Health Data Breaches as Privacy Act Falls Behind Global Standards In late 2025, New Zealand experienced two significant cyberattacks targeting healthcare systems, exposing critical gaps in the country’s privacy protections. The first breach involved Manage My Health (MMH), a patient portal used by public health organizations, where ransomware attackers accessed and exfiltrated medical records of approximately 120,000 patients, threatening to leak them on the dark web. Weeks later, on February 22, 2026, MediMap a portal used by aged-care homes, hospices, and disability services was taken offline after unauthorized actors tampered with patient records, including altering names, birthdates, and even marking living patients as "deceased." These incidents, among the most severe in New Zealand’s history, have intensified scrutiny of the Privacy Act 2020, which critics argue lacks sufficient enforcement mechanisms. Unlike global counterparts such as the EU’s GDPR or Australia’s Privacy Act, New Zealand’s law imposes no civil penalties for breaches of core privacy principles, such as failing to secure personal data. The only financial consequences up to NZD10,000 apply to failures to notify the Privacy Commissioner of a breach, while damages awarded through the Human Rights Review Tribunal (capped at NZD350,000) require proof of harm and a lengthy judicial process. The Office of the Privacy Commissioner (OPC) reported a 43% increase in serious breach notifications in its 2024-25 annual report, underscoring the urgency for reform. Without stronger penalties, privacy risks losing priority to other corporate concerns, leaving New Zealanders vulnerable. The breaches also raise concerns about the country’s EU adequacy status, which could be jeopardized if privacy protections fail to meet international standards. In response, Prime Minister Christopher Luxon acknowledged the need to strengthen cybersecurity laws, coinciding with the release of New Zealand’s Cyber Security Strategy 2026-2030 on February 27, 2026. The accompanying Action Plan 2026-2027 tasks the Ministry of Justice with exploring civil penalties for privacy violations and a potential new offense for mishandling illegally obtained data. While some organizations argue they already prioritize privacy, the recent breaches suggest systemic vulnerabilities reinforcing calls for legislative reform to align with global best practices.