Information for people impacted by the Manage My Health data breach

Print | Email this page

Office of the Privacy Commissioner | Information for people impacted by the Manage My Health data breach

12 Jan 2026, 09:00

Everyone in New Zealand has privacy rights. Read about your privacy rights.

The Privacy Act places responsibility on organisations that collect, use or store your personal information to keep it safe and secure using all reasonable steps. Failure to take reasonable steps to protect your personal information against unauthorised access is a breach of the Privacy Act. If you experience actual or potential privacy harm because of this, you can make a complaint under the Privacy Act.

What has happened?

Manage My Health provides patient portal services to health providers and their patients (registered users).

On 1 January 2026, Manage My Health notified us that it had been affected by a serious cyber incident involving the sensitive health information of thousands of users. Ransom hackers accessed and downloaded documents stored in the My Health Documents section of Manage My Health, including:

• files uploaded by individual users such as correspondence, reports or results
• hospital discharge summary documents for Northland Hospital patients (including clinical letters)
• referral letters from GPs to specialists and other health providers between 2017 and 2019.

Read more detail on Manage My Health's website where they're giving updates and have answers to frequently asked questions.

Find out if you are impacted

Manage My Health is working with Health New Zealand and affected GPs to contact people whose information has been impacted by the breach directly via email to confirm this and advise how to log in to Manage My Health to find out what information has been affected. Read updates on progress with notification on Manage My Health's website.

If you are a user of Manage My Health, and you don't want to wait to be notified, you can log in to check if your information has been affected or not. Find out how to check your accounts security status by reading Manage My Health's FAQs - Account Security Status.

When you log into Manage My Health you will be given a reference number - keep hold of this for your records. It will be used to help identify you as an affected patient if you choose to use the 0800 number. You will also need the reference number if you wish to make a complaint.

If you are an impacted patient

If you have found out you are an impacted patient and you are worried or have questions:

• Manage My Health has set up an 0800 helpline. This is for affected patients only. Access to the 0800 number is provided when you receive confirmation that that you are affected either by email or when you log in. Dialing the number will provide you with access to identity and cyber support services or medical advice. Both services are free and confidential. You will be asked for your reference number to ensure that you are an affected patient.
• For emotional support, call or text 1737 Need to Talk? any time, for free. Read our detailed information - including links to other services - about managing your mental distress.
• You can contact your general practice if you have questions or concerns about your health information.
• Read Manage My Health's FAQs related to the cyber breach.

How to secure your personal information

It's really important that you take immediate steps to secure your personal information after a data breach. Hackers and scammers use your information to try and gain access to your accounts or to scam you. Read the National Cyber Security Centre's (NCSC) tips for keeping safe after a data breach.

You can also read our information about protecting your personal information.

Making a privacy complaint

If you experience actual or potential privacy harm because of the Manage My Health data breach, you can make a complaint under the Privacy Act. If you wish to make a privacy complaint, you must first complain to the organisation responsible for your information under the Privacy Act and give them an opportunity to respond and put things right.

Manage My Health provides patient portal services on behalf of health providers and can also provide services directly to registered users. For this reason, we suggest you complain to MMH and copy in your health provider (usually your GP - you should have their contact details). If the breached information is your hospital discharge summary documents from Northland Hospital, we suggest that you complain to MMH and copy in Northland Hospital.

• Manage My Health complaints can be sent to [email protected]

Our online complain to another agency form can help you put together and lodge your complaint. You will need your reference number.

If you are not satisfied with their response/s and you believe that your privacy has been harmed, you can use our online complaint form to make a complaint to the Privacy Commissioner. Read more about our complaints process.