Manage My Health data breach - what you need to know 

A cyber security breach has affected some patient information held by Manage My Health, a private online health portal used by some healthcare providers.

Health NZ is working with government agencies to support Manage My Health and help keep people safe.

Health NZ's own systems and other patient portals have not been affected by this breach.

Importantly, My Health Account and My Health Record have not been affected as they are separate, secure services operated by Health NZ.

If you are worried or have questions, you can find support and practical steps below.

The data breach involved documents stored in the My Health Documents section of Manage My Health, including:

• files uploaded by users
• some hospital discharge summaries
• specialist referral letters.

The data breach did not involve clinical systems, prescriptions, secure messages or appointment bookings.

For questions about Manage My Health, visit support at Manage My Health.

Manage My Health — Support (external link)

For emotional support, call or text 1737 Need to Talk? any time, for free.

For privacy concerns, contact the Office of the Privacy Commissioner.

Office of the Privacy Commissioner (external link)

For concerns about your rights, contact the Health & Disability Commissioner.

Health & Disability Commissioner (external link)

Has my account been involved?

If your information was involved in this breach, Manage My Health will contact you directly. Patient notifications are being sent in phases after healthcare provider practices were informed first. Patient notifications started on 8 January 2026 with most being sent over 48 hours with other groups including vulnerable people being notified separately to ensure they receive specific support. For the latest updates, check  Manage My Health (external link)

I don't remember which health portal I use — am I affected?

If you use or previously used Manage My Health, you may be affected, even if your practice has changed the health portal it uses.  

Ask your general practice or check Manage My Health – Cyber Breach FAQs. 

Manage My Health – Cyber Breach FAQs (external link)

Should I change my Manage My Health password?

Yes, it is good practice to update your password and enable two-factor authentication. You can use Google Authenticator or Microsoft Authenticator. For advice on how to do this go to Manage My Health – Two step verification (you will need to sign in to your account).

Manage My Health – Two step verification (external link)
 
For guidance on staying protected online see Own Your Online. 

Own Your Online – Get protected (external link)

Should I delete/close my My Health Account or My Health Record?

My Health Account and My Health Record are separate services operated by Health NZ.  

• They were not affected by the Manage My Health breach.  
• They remain secure.

My Health Account and My Health Record help you access trusted government health information and future digital services. We do not recommend closing them because of this incident.  

If your concern is with Manage My Health (the private health portal) you can ask Manage My Health to delete your account via their support page. 

Manage My Health – Support (external link)

Deleting your Manage My Health account does not affect your My Health Account or My Health Record.  

If you still want to close your My Health Account, you can request this by either:

• calling Health NZ on 0800 222 478, Monday to Friday, from 8am to 5pm
• or emailing support@identity.health.nz

Keeping your My Health Account does not increase any risk from this breach and it supports secure access to Health NZ services.  

Should I contact the police?

If you have been notified that your data is included in the data breach, there is no need to contact police as this has been covered by the Manage My Health report to police.

However, police should be contacted if there is evidence of second-tier misuse, such as identity theft, fraud, or criminal activity involving your information.