Overview
- A December cyberattack on the Manage My Health portal exposed nearly 100,000 patients’ records when attackers used compromised credentials and a platform vulnerability to access the 'My Health Documents' area.
- Privacy Commissioner Michael Webster concluded Health NZ and Manage My Health breached Principle 5 of the Privacy Act by failing to have adequate technical and governance safeguards.
- The commissioner intends to issue compliance notices to force remaining remediation work and independent verification that security changes are effective.
- Independent reviews by Deloitte and CyberCX found widespread control failings and inconsistent security across the health sector, and said Manage My Health was unprepared for an incident of this kind.
- More than 70% of those affected were in Northland because of a local hospital discharge data arrangement, Health NZ has stopped those discharge feeds, patients can receive paper summaries, and GPs were cleared as not responsible for the breach.