ManageMyHealth Data Breach

Forums › Health and fitness › ManageMyHealth Data Breach

1 | ... | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | ... | 29

6736 posts

Uber Geek
+1 received by user: 2929

Subscriber

#3450581 7-Jan-2026 15:51

Rikkitic:

They have stated publicly that they know who was affected and who wasn't. At the very least, politeness would suggest that this information be shared with those involved. Not just the affected, but also the unaffected. The silences are deafening and the lack of information more than annoying!

MMH's CEO has stated that only the "Health Documents" folder was affected. In my case that folder is empty. Anything going to the GP from 3rd parties has been filed in the Health Records folder. AFAIK if your Documents folder is empty you are a bystander.

Behodar

11117 posts

Uber Geek
+1 received by user: 6116

Trusted

Lifetime subscriber

#3450585 7-Jan-2026 16:01

Thanks. Mine's empty (and I haven't heard anything from them directly).

Rikkitic

Awrrr
19086 posts

Uber Geek
+1 received by user: 16356

Lifetime subscriber

#3450586 7-Jan-2026 16:04

Same here but this shouldn't be left to patients to figure out. This whole thing is a massive clusterf*ck!

Plesse igmore amd axxept applogies in adbance fir anu typos

zenourn

281 posts

Ultimate Geek
+1 received by user: 168

ID Verified

Trusted

#3450591 7-Jan-2026 16:29

matthewperrin:

please dont be mmh... ffs

Yes, I assume this relates to Saudi Icon (which is 4.15 TB) rather than MMH

matthewperrin

22 posts

Geek
+1 received by user: 11

#3450596 7-Jan-2026 16:34

michaelmurfy:

matthewperrin:

Good! Extremely happy to hear it!

Maybe the complexity was them figuring out how to use signal 🤣

Erm… not sure if you’re being sarcastic or not.

This is not a good thing for 3 reasons:

1) Breach of sanctions / Anti Money Laundering.

2) Paints a target on Manage My Health as a company who pays meaning they’re likely going to get targeted again.

3) Paints a target on NZ Health / other NZ businesses as a country that pays.

What sanctions? Cuba is not under any sanctions.

2) good 3) good, perhaps instead of relying on others to do your security work for you black-hat style, get proactive.

matthewperrin

22 posts

Geek
+1 received by user: 11

#3450598 7-Jan-2026 16:36

Bung:

Rikkitic:

They have stated publicly that they know who was affected and who wasn't. At the very least, politeness would suggest that this information be shared with those involved. Not just the affected, but also the unaffected. The silences are deafening and the lack of information more than annoying!

MMH's CEO has stated that only the "Health Documents" folder was affected. In my case that folder is empty. Anything going to the GP from 3rd parties has been filed in the Health Records folder. AFAIK if your Documents folder is empty you are a bystander.

I already queried some docs but don't know any GP's who are working right now.
It's apparently exclusively used by GP's.
My query was along the lines of - does the GP clinic have the ability to use that feature associated with a patient, and to hide documents from them?
As in, are we able to see all our docs there by logging in and looking.

New World

Shop on-line at New World now for your groceries (affiliate link).

gzt

18756 posts

Uber Geek
+1 received by user: 7883

Lifetime subscriber

#3450599 7-Jan-2026 16:43

matthewperrin: What sanctions? Cuba is not under any sanctions.

Cuba has been under various USA sanctions more or less since the revolution in 1959. Iirc NZ does not have any direct sanctions on Cuba but the USA sanctions can make trouble for anyone trying to trade related to international financial services.

I understand some types of businesses continuity insurance cover aspects of ransom negotiation and payment. Claiming Cuba as a location seems like it would make things much more difficult for that process, not easier. I'd guess there is some technical reason for that.

geek3001

224 posts

Master Geek
+1 received by user: 334

ID Verified

Subscriber

#3450600 7-Jan-2026 16:50

Bung:

MMH's CEO has stated that only the "Health Documents" folder was affected. In my case that folder is empty. Anything going to the GP from 3rd parties has been filed in the Health Records folder. AFAIK if your Documents folder is empty you are a bystander.

This report https://dailydarkweb.net/managemyhealth-data-breach-kazu-group-claims-ransomware-attack/ referenced earlier in this thread, claimed the following info was in the breach:

Full names

Medical records

Test results ***

Prescription data ***

Appointment schedules ***

Health history logs ***

Personal communication with healthcare providers ***

The ones I have marked *** are things that are stored and accessible elsewhere in MMH, certainly in my case anyway.

If this report has not been discredited, I feel that until we receive official confirmation, it is possible that data outside of the "My Health Documents" module may be in the breach too.

gzt

18756 posts

Uber Geek
+1 received by user: 7883

Lifetime subscriber

#3450602 7-Jan-2026 17:02

RNZ is reporting a patient who changed their GP two years ago and no longer used MMH was affected. I think we expected that:

https://www.rnz.co.nz/news/national/583398/ex-users-data-may-have-been-stolen-in-manage-my-health-breach

One part I've always been curious about - When you get an invite from your GP to use MMH for the first time - is your data already on MMH at that point? Ie; doesn't matter if you login or not ever - your data is already there if you got an invite even if you didn't respond?

matthewperrin

22 posts

Geek
+1 received by user: 11

#3450603 7-Jan-2026 17:05

geek3001:

Bung:

MMH's CEO has stated that only the "Health Documents" folder was affected. In my case that folder is empty. Anything going to the GP from 3rd parties has been filed in the Health Records folder. AFAIK if your Documents folder is empty you are a bystander.

This report https://dailydarkweb.net/managemyhealth-data-breach-kazu-group-claims-ransomware-attack/ referenced earlier in this thread, claimed the following info was in the breach:

Full names

Medical records

Test results ***

Prescription data ***

Appointment schedules ***

Health history logs ***

Personal communication with healthcare providers ***

The ones I have marked *** are things that are stored and accessible elsewhere in MMH, certainly in my case anyway.

If this report has not been discredited, I feel that until we receive official confirmation, it is possible that data outside of the "My Health Documents" module may be in the breach too.

Technically a single scanned prescription request with an NHI sticky on the top could contain all of that to some extent.

geek3001

224 posts

Master Geek
+1 received by user: 334

ID Verified

Subscriber

#3450604 7-Jan-2026 17:05

Today's update at https://managemyhealth.co.nz/mmh-cyber-breach-update-7-january-2026/ says:

Patient notifications

Manage My Health will begin notifying patients in the next 24 hours and we hope to complete this process by early next week. Notifications will be sent initially through email to the address that was used to register the account.

MMH has been liaising with Health New Zealand, the OPC, GPNZ, and GP practices to ensure patients receive clear, consistent information and do not receive multiple or confusing notifications from different organisations about the same incident.

The email notifications will include an 0800 number that impacted individuals can call to get support and assistance should they require.

Advisory Board

MMH is establishing an advisory board providing added clinical and technical support in the management of this unprecedented criminal cyber incident. One appointee has been announced today and further appointees will be announced over the coming days.

Ross Tanner has been appointed as an advisor on privacy matters and governance for Manage My Health. He is a seasoned governance and public‑sector management expert with extensive career experience in the State sector including senior management roles in Government departments and participation on the boards of Crown entities (including serving as a former Deputy State Services Commissioner) and private companies. Ross has also chaired a number of voluntary sector boards.

Lego

Shop now for Lego sets and other gifts (affiliate link).

gzt

18756 posts

Uber Geek
+1 received by user: 7883

Lifetime subscriber

#3450605 7-Jan-2026 17:08

I feel sorry for the General Practitioners having to deal with all this. The stress on practice staff and management could be pretty bad for some. Hopefully the various professional bodies and associations will be providing appropriate support.

geek3001

224 posts

Master Geek
+1 received by user: 334

ID Verified

Subscriber

#3450606 7-Jan-2026 17:09

matthewperrin:

Technically a single scanned prescription request with an NHI sticky on the top could contain all of that to some extent.

Perhaps, but not the "Personal Communication with Healthcare Providers". In my case that sits in the "Messaging" module.

In my case all of my prescriptions are available under "My Health Records" not "My Health Documents".

boosacnoodle

1292 posts

Uber Geek
+1 received by user: 877

#3450613 7-Jan-2026 17:28

Logging in now and not seeing any Health Documents may not necessarily indicated you were not breached. My GP turned that function off and now no documents are showing - but they were showing before.

Batman

Mad Scientist
30018 posts

Uber Geek
+1 received by user: 6218

Trusted

Lifetime subscriber

#3450662 8-Jan-2026 07:10

gzt: RNZ is reporting a patient who changed their GP two years ago and no longer used MMH was affected. I think we expected that:

https://www.rnz.co.nz/news/national/583398/ex-users-data-may-have-been-stolen-in-manage-my-health-breach

One part I've always been curious about - When you get an invite from your GP to use MMH for the first time - is your data already on MMH at that point? Ie; doesn't matter if you login or not ever - your data is already there if you got an invite even if you didn't respond?

so i guess i can assume people whose gp use the mmh but if the patient is not a registered user, they have all their data there but no rights, no notification, as they are not registered user

1 | ... | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | ... | 29