We wanted to give everyone an update on the recent cybersecurity breach at ManageMyHealth (MMH) and to recognise the distress and concern this news will be causing.
Please note – the patient management system currently being used by Kaipara Medical Centre, is MyInidici, not ManageMyHealth.
What happened?
On 30 December 2025, MMH identified unauthorised ransomware activity within the My Health Documents module of the ManageMyHealth app. This activity was the result of a criminal cyberattack.
Once detected, MMH secured its systems, isolated the affected environment, and engaged independent cybersecurity and forensic specialists. They have also notified and are cooperating with Health New Zealand, the Privacy Commissioner, New Zealand Police, and other relevant authorities.
Do we have any patients affected by the cyber incident?
Yes, we have some patients that have been affected by the hacking. These patients are being contacted in tranches by the MMH team to let them know they were affected, next steps, and to offer appropriate support.
Why have we not notified affected patients ourselves?
The Office of the Privacy Commissioner (OPC) has asked for a co-ordinated approach to notification rather than having hundreds of individual practices undertake the process; therefore, the OPC has asked MMH to manage the notification process. We have to respect the wishes of the government and follow due process.
When will the notification of patients start?
MMH has told us that the notification process to affected patients started last week, Thursday 8 January and is likely to take up to a week to complete.
MMH has made updates to its website with an “account security status” notification. A green box that states "Account Security Status: No Impact" means the account has not been accessed. If it has a “red” security status note the account has been affected and a reference number will be provided and the 0800 number to ring for further support.
Where can I go for more information?
MMH has published answers to common questions, including why communication timing can vary and what terms like “accessed” mean. You can find this information here: https://managemyhealth.co.nz/faqs-cyber-breach/
We understand that situations like this can be concerning and frustrating – especially as much of the process sits outside of our control.
As a reminder, this incident relates to ManageMyHealth, not our practice systems, and does not affect the care we provide. If you are experiencing any distress or feel you need to speak to someone, please call our reception team to make an appointment with one of our clinicians.
