Author: MIL-OSI Publisher

Source: Radio New Zealand

In one of the biggest privacy breaches in New Zealand history, at the end of 2025 hackers got access to health data being held by privately owned patient portal Manage My Health.

The cyber criminal(s) demanded thousands of dollars as a ransom, threatening to otherwise release the data on the dark web, potentially exposing more than 120,000 New Zealanders’ medical details.

Here is a recap of what has happened, and what we know, so far.

2020

Patient portal Manage My Health, founded in 2008, was spun out of Medtech Global into founder Vino Ramayah’s Cereus Holdings. It had 700,000 users at this stage – a number that would grow to more than 1.8 million over the next five years.

Earlier in 2025

In July, a digital forensics and cyber security company in Nepal reported a hacker going by the name ‘Kazu’ allegedly stole 1.4TB of data from the Nepali Ministry of Education, Science, and Technology, including student information and academic transcripts.

Similar claims were made about attacks on a doctors group in Texas, the Colombian Ombudsman, the Thai Department of Agricultural Extension, the Kuwait Ministry of Public Works, the Bolivian Navy and more.

30 December, 2025 (NZ time)

A hacker (or group) calling themselves Kazu posted online they had breached Manage My Health, claiming to have 108GB of data, made up of 428,337 files including names, medical records, test results, prescription details and more. A small sample of data was published as proof.

Kazu demanded US$60,000 (NZ$104,000) as a ransom, giving a deadline of 15 January.

31 December

Manage My Health confirmed it had been breached. Ramayah said the incident was being investigated by the company alongside authorities and independent cybersecurity specialists.

1 January, 2026

The company revealed between 6 and 7 percent of the approximately 1.8 million registered users may had been impacted by the breach, and it expected to start notifying affected patients within 48 hours.

Ramayah said the Office of the Privacy Commissioner, Health NZ police had been notified and the breach had been “contained”.

Duty minister Karen Chhour said the breach was “incredibly concerning” for patients. Health NZ said it was working “closely” with the app’s operators, and its own systems were not affected.

Health Minister Simeon Brown later that day said the breach was concerning, but would have no clinical impact on patient care.

The president of the College of GPs said he only learned about the potential breach through the media, calling it “terribly disappointing”, while the chair of General Practice NZ said it was an urgent situation.

3 January

The Public Service Association said the security breach highlighted the risk of cutting IT experts in public health. (While used by practices in the public system, Manage My Health is privately owned.)

Manage My Health said it had fixed the flaws in its code which allowed the breach. Just one part of the app had been accessed – Health Documents – and the company now had a list of everyone affected.

The company urged users to enable two- or multi-factor authentication if they had not already, to improve security. It also said users should “keep an eye out for anything unusual, such as medical bills or insurance claims you don’t recognise, or unexpected letters from healthcare providers”.

4 January

Kazu brought forward the deadline for Manage My Health to pay, from 15 January to Tuesday, 6 January.

Manage My Health said it had identified which general practices were affected and set up an 0800 number people could contact them on. The company was yet to start contacting patients, despite promising on New Year’s Day to do so within 48 hours.

Health NZ established an incident management team and was co-ordinating with other government agencies, including the National Cyber Security Centre and the Police Cyber Crime Unit, on the breach.

5 January

Health Minister Simeon Brown announced a review by the Ministry of Health into the response to the breach.

ManageMyHealth said it had filed papers in court seeking an injunction on publication of the stolen files. Brown said ManageMyHealth was “ultimately responsible” for managing the breach.

The National Cyber Security Centre said it was “working with Health NZ and other government agencies”.

6 January

The revised deadline passed without any data being released. There were later reports it had been moved to Friday, 9 December.

Manage My Health said it received an injunction from the High Court.

Brown said he had told the company to improve its communications with patients.

A group representing GPs said they still did not know which practices had been affected.

A person claiming to be Kazu told the NZ Herald they were motivated by profit and notoriety.

“Most companies do pay the ransom. In fact, even if the government does not allow it, they pay privately without disclosing it.”

The person described ManageMyHealth’s security as lacking “basic security protocols”.

7 January

Ramayah revealed the hacker “got in through the front door” of the website by simply using a “valid user password”.

The CEO said he was open to standing down if required after his company “dropped the ball”, but said Manage My Health itself was also the victim of a crime.

Mysteriously, Kazu removed all references to the Manage My Health data breach from its online presence.

It was revealed data belonging to people who had closed their Manage My Health accounts was still available on the portal.

Manage My Health began the process of telling general practices and individual patients if they had been affected.

Lawyers called for tougher penalties for companies who fail to protect clients’ data.

8 January

It was revealed patients who stopped using Manage My Data in the past were still having their new medical information added to its database.

Manage My Health’s website struggled with the number of people trying to find more information about the hack.

9 January

Some patients reported receiving conflicting information from the company on whether their data had been stolen.

The 0800 struggled with the volume of calls, while New Zealanders overseas were told they could no longer use the app due to security reasons. Others received confusingly blank emails from the company.

10 January

It was revealed most of the affected patients were based in Northland – about 86,000, and nearly 50 practices.

Manage My Health had notified about half of the 125,000 whose data had been stolen.

12 January

Northland GPs expressed frustration at the conflicting information they were getting from Manage My Health.

A second health provider, CanopyHealth, revealed it had been targeted in a cyber attack in July, the delay infuriating clients.

The Office of the Privacy Commissioner issued guidance for affected patients on what to do if their data had been exposed.

13 January

An IT expert expressed surprise the KFC app had stronger security protocols than Manage My Health.

Kazu claims to have stolen data from MyVete, a Spanish veterinary management system.

There had been no further mention of the Manage My Health data from the hackers since the last reported deadline passed (9 January).

14 January

Manage My Health admitted some people it told had been affected by the hack, had not.

Two weeks after the breach was first reported, Prime Minister Christopher Luxon was yet to make any public statement about the matter.

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand

Source: Radio New Zealand

Two people have minor injuries after a crash involving a police vehicle.

Senior sergeant Fane Troy said police were called about 3.15pm on Wednesday about the two-vehicle crash on State Highway 1 in Piarere.

It involved a police car and member of the public’s car.

“Both drivers, who were the sole occupants of the vehicles, received minor injuries and were assessed by ambulance staff on scene,” Troy said.

“Both vehicles received extensive damage, and the northbound lane is currently blocked.

“The Serious Crash [Unit] are in attendance.”

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand

Source: Radio New Zealand

A survey of emergency department nurses shows a majority were subjected to abuse over the festive season.

The New Zealand Nurses Organisation survey of showed 84 percent of those who worked over the Christmas/New Year reported dealing with unacceptable behaviour.

The union said more than half felt the emergency department was understaffed at the time, and safe staffing levels and more security was wanted.

According to the survey:

The union’s college of emergency nurses spokesperson Natasha Hemopo said a “chronic shortage” of health workers had contributed to increased wait times in emergency departments, which was causing frustration for patients and whānau, and compromising the quality of patient care.

Hemopo said she was not surprised by the survey’s results, which in itself was disappointing.

“Nurses constantly raise concerns about the link between patients’ frustrations which lead to abusive behaviour and short staffing in EDs. This survey further highlights the correlation between under-staffing and unsafe staffing,” she said.

“When your system’s under-funded, under-resourced, then one of the trade-offs I guess is you’re going to see a high increase in violence towards our staff.”

Overall, 58 percent of respondents said they ‘usually’ felt safe generally, while 33 percent said ‘sometimes’.

The holiday period was different, Hemopo said, as patients were often coming in from outside their own region or unable to see their GP.

Of those who were assaulted over the survey period, 55 percent said they reported it.

“Concerningly, the main reasons for not reporting incidents were lack of confidence in the system or lack of time,” Hemopo said.

She said the expectation was to report an incident verbally to a senior or duty manager, and then log in through an incident reporting system.

“Honestly, I’ve done it, and sometimes they can take you up to an hour. And when you’ve done a long, busy shift, sometimes up to 12 hours, the last thing you want to do is stay in your own time and fill out a reporting system.

“Sometimes when nurses do it, they don’t necessarily get the feedback that is helpful or the feedback that helps that situation. So our nursing staff just become despondent about doing these reporting forms.”

The survey showed 55 percent also felt the emergency department was under-staffed at the time of the incident.

“Patients need nurses to have safe staffing levels, not the government’s artificial target of having 95 percent of patients admitted, discharged or transferred from an ED within six hours,” Hemopo said.

“The ED target doesn’t change the reality of under-resourced EDs for patients or for nurses.”

The NZNO also wanted 24/7 specially trained security in all EDs, to protect patients and allow staff to do their jobs safely.

Health minister Simeon Brown said the government had committed $31 million in Budget 2024 towards strengthening hospital security, including increasing security in the country’s eight busiest EDs, boosting security surge capacity for all EDs, and providing additional training for Health New Zealand’s security team of more than a thousand staff.

“Our nurses, doctors, and other healthcare professionals work tirelessly to care for patients in emergency departments and hospitals every day. They deserve to come to work feeling safe and to be treated with respect,” Brown said.

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand

Source: Radio New Zealand

A WorkSafe investigation is underway following the death of a road worker who was struck by a vehicle in the central North Island.

Emergency services responded to the fatal crash on the Taihape-Napier Road shortly after 11.20am on Tuesday.

Police said the crash involved a vehicle and a pedestrian, who died at the scene. They said the driver was also injured.

WorkSafe has since launched an investigation.

“WorkSafe and police are jointly investigating the circumstances of a road worker’s death yesterday at Ngamahanga in Hawke’s Bay,” a spokesperson said.

Rangitīkei district mayor Andy Watson said council contractors were carrying out work in the area.

He said he was unable to confirm the details of what happened but said his heart went out to the road worker’s family.

“Any loss of life is a tragedy and the circumstances are such that somebody doesn’t go home to their loved ones.”

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand

Source: Radio New Zealand

A dog has been rescued from a hot car that had an internal temperature of more than 49C.

The SPCA said reports of dogs being left inside hot cars continue to “roll in” despite its best efforts to make owners aware of possibly “horrific outcomes”.

A recent case saw the SPCA called to a car in Christchurch where they were able to rescue the dog “just in time”.

“The temperature inside had reached over 49C. It was about 28C outside the car and the owner had cracked the windows, believing this would make the car cool enough.”

Another case saw SPCA inspectors also need to get a dog out of a overheated vehicle.

“This owner had left their dog with a bowl of water, also thinking this ensured the dog’s safety.

“The dog had knocked over the water bowl, and was luckily removed from the car by our team.”

SPCA said the only way to ensure the dog’s safety was to leave them at home, with a friend or family member, or take them with you.

In 2022, it was reported that the SPCA had received 214 complaints about dogs being left in hot cars in the past year.

At the time, SPCA inspector Ben Lakomy said it was disappointing the message still was not getting through to some people.

“It is an offence under the Animal Welfare (Care and Procedures) Regulations 2018, to leave a dog in a hot vehicle if they are showing signs of heat stress, such as excessive panting, drooling or hyperventilation, and trying to seek shade.

“When it’s 21 degrees Celsius outside, temperatures in a car parked in the shade with the windows down can exceed 31C in less than 10 minutes. In 30 minutes, it goes up to 40C. On a hot day, the temperature inside the vehicle can exceed 50C.”

Pet owners, whose dogs were found in this state, could be issued with a $300 infringement notice.

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand

Source: Radio New Zealand

Fire and Emergency has sent out a smoke warning in Dunedin as crews battle a fire in the Roslyn Scout Hall.

It said the fire is producing large amounts of smoke, particularly in the Kaikorai Valley north of Stuart Street.

Fire and Emergency said people in the area should stay inside with doors and windows shut to avoid being exposed to smoke.

“Firefighters are working to put the fire out. Please avoid the area so emergency services are not delayed.”

Photos shared with RNZ show a two-storey building engulfed in flames.

Police said officers were called to assist at the scene at about 3.40pm.

“Cordons are in place on Stuart Street from Kaikorai Valley Road to Highgate.

“Motorists are advised to avoid the area and expect delays.”

Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.

– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand