In late December 2025, New Zealand’s digital health ecosystem faced a sharp reminder of how exposed critical services have become.

The online patient portal ManageMyHealth suffered an unauthorised intrusion that resulted in the exfiltration of more than 400,000 medical documents linked to over 120,000 patients.

The breach prompted urgent High Court action, regulatory scrutiny and a government-commissioned cyber security review across the health sector.

While national health databases were not directly compromised, the incident raised serious concerns about the protection of highly sensitive health information, vendor oversight and systemic resilience across interconnected platforms.

At the time of writing, the dollar impacts are still unfolding, but events of this scale typically involve multi-million-dollar costs across forensic investigations, legal advice, privacy notifications, regulatory engagement, crisis communications and technology remediation.

Premium

You need to Log In to access this

Log In

What are CIP Points? About ANZIIF Membership