A cyber security breach has been reported at ManageMyHealth, New Zealand’s largest patient information portal, though the company states the incident has been “contained.” The breach, involving “unauthorised access” to the platform, was confirmed on Wednesday, leaving both patients and general practitioners awaiting clarity on whether personal health records have been compromised.
Government Response and Investigation
Duty minister Karen Chhour has expressed serious concern regarding the breach, stating it is “incredibly concerning” for patients. The Minister of Health has requested urgent assurances from both Health New Zealand and ManageMyHealth regarding the protection of patient data and privacy, and expects transparent communication to maintain public trust. ManageMyHealth CEO Vino Ramayah confirmed an ongoing investigation in collaboration with relevant authorities and cybersecurity specialists, promising updates as information is verified.
Scale of the Breach and Ransom Demand
While the full extent of the breach remains unclear, initial assessments suggest a significant volume of data may be involved. A cyber crime group, Kazu, claims to have compromised approximately 108 gigabytes of information, totaling over 400,000 files, and has issued a ransom demand of $60,000 by January 15th. This claim of a ransomware attack is being taken seriously, drawing parallels to a previous major incident at the Waikato DHB.
Concerns from General Practitioners
The lack of timely communication from ManageMyHealth has prompted criticism from family doctors. Dr. Luke Bradford, president of the College of GPs, learned of the potential breach through media reports. He emphasized the critical role ManageMyHealth plays in patient care, allowing access to records and improved health management, but stressed the importance of data security. Dr. Bryan Betty, chair of General Practice NZ, echoed these concerns, calling for transparency and urgent action.
Potential Next Steps
If the ransom demand is not met, it is possible the compromised data could be released publicly. ManageMyHealth could face significant legal and reputational consequences. Health New Zealand may be compelled to review and strengthen cybersecurity protocols across the healthcare sector. Patients and GPs could experience disruptions to healthcare services as systems are assessed and potentially rebuilt. It is also likely that further investigation will reveal the specific vulnerabilities exploited in this attack.
Frequently Asked Questions
What is ManageMyHealth?
ManageMyHealth is the country’s largest patient information portal.
What is the government doing about the breach?
The Minister of Health has asked for urgent assurances from Health NZ and Manage My Health that everything is being done to protect patient data and patient privacy.
Has any data been stolen?
A cyber crime group, Kazu, claims to have compromised approximately 108 gigabytes of information, totalling over 400,000 files.
As investigations continue, what level of security do you believe is necessary to protect sensitive personal health information in an increasingly digital world?
Keep reading