A serious cyber attack in NZ exposes major weaknesses in NZ’s regulatory regime.
What happened
In 2019, the Northland District Health Board (later absorbed into the Ministry of Health) struck a unique design agreement with MMH. The goal was to allow patients to easily log into a web portal and view their hospital discharge summaries, outpatient records, and clinical letters. The new system rolled out between 2023 and 2025.
In December 2025, the hacker group “Kazi” simply bought (or stole) a set of valid user login credentials. Once they walk through the front door using this real password, they find a major flaw in the portal's API security and access controls. Because Multi-Factor Authentication (MFA) is entirely optional rather than mandatory, there is no second lock to stop them.
Using that single stolen user account, the hackers are able to manipulate the system to systematically query, view, and exfiltrate over 400,000 highly sensitive medical documents belonging to 99,416 entirely different patients. Bizarrely, MMH’s own internal monitors do not even notice the massive, unusual data siphon; it is Health NZ that eventually spots the anomaly and alerts them on December 30, 2025
Why it happened
Data minimisation: The Ministry allowed the contract to be structured in a way that permitted MMH to hoard data indefinitely. MMH continued to hold historical hospital records for thousands of patients whose local clinics had long stopped using the portal, expanding the "blast radius" of the eventual breach.
Technical due diligence / procurement failures: The Ministry commissioned a report from Deloitte to review the incident. The report surfaced a number of failings in connection with the Ministry’s selection and engagement of MMH as a vendor.
There was no competitive tender. MMH was selected as a “preferred supplier” right from the start.
The Ministry engaged MMH as a “design partner” effectively locking MMH in as the only vendor that could do the job.
Over-reliance on self-assurance. The Ministry relied on MMH ticking boxes and agreeing to policies, rather than demanding written penetration testing evidence or independent SOC 2 reports.
The contract between the Ministry and MMH was found to be not fit for purpose. The contract did not contain appropriate cyber security or privacy clauses, or require API patching or MFA.
Multi factor authentication: MMH did not make multi-factor authentication mandatory.
API security: MMH did not deploy appropriate API security. The hacker exploited the fact that MMH’s internal portal API (which let a patient’s web browser or mobile app display documents obtained from MMH’s servers) failed to verify whether the logged-in user actually had permission to look at other people's documents. In addition, MMH did not deploy rate limiting or throttling (which would typically trigger an alarm if someone is downloading a lot of documents).
Governance: When the Ministry set up the project steering group to oversee the procurement and rollout, they omitted crucial expertise. The steering committee completely lacked dedicated, specialized privacy or security representation.
The consequences
Kazu posted samples of highly intimate clinical notes, medical scans, and passport copies online, demanding a US$60,000 ransom to halt a full release
The Privacy Commissioner’s inquiry pulls back the curtain to reveal that this tragedy was entirely preventable, declaring that both main actors shared systemic fault.
Manage My Health: Failed to mandate MFA, possessed ineffective web security and data leak protection, and crucially, ignored its own testing themes and a specific November 2017/2025 API security warning passed on by the Health Ministry. They hoarded data, continuing to harvest and store records for patients whose clinics had long severed ties with the platform.
The Ministry: Engaged MMH without proper technical due diligence. Their steering committees completely lacked specialized privacy or security representatives, they relied blindly on MMH’s self-assurances rather than auditing them, and they signed contracts that were legally "not fit for purpose" to protect patient information.
Privacy Commissioner Michael Webster formally finds both entities in breach of Rule 5 of the Health Information Privacy Code. He issues binding Compliance Notices to both organizations, legally forcing them to overhaul their environments. The Ministry is forced to completely freeze the flow of all clinical data to the portal, leaving the project in tatters and forcing public apologies to thousands of citizens who discovered their data was being stored there without their active knowledge.
Comment
NZ’s Privacy Act has not kept up and is dangerously behind. The Act does not allow the Commissioner to fine the Ministry or MMH. The OPC’s maximum enforcement mechanism for a systemic failure is issuing a Compliance Notice (which it has done for both entities), legally forcing them to fix their systems. However, fines under the Act are capped at $10,000 and apply only to specific, narrow administrative criminal offenses, such as failing to report a serious breach or ignoring a formal Compliance Notice after it has been issued. Affected individuals may be able to ask the Privacy Commissioner to bring an action in the Human Rights Review Tribunal, but this is a lengthy process and the HRRT rarely awards damages for cyber failures. NZ desperately needs to catch up so as to deter similar failures in the future.