Hackers Steal Hundreds of Thousands of Medical Files in New Zealand

Cybercriminals have claimed responsibility for a major data breach in New Zealand, saying they accessed medical records belonging to more than 100,000 people in one of the country’s most serious healthcare cybersecurity incidents.

A hacking group operating under the name Kazu said it infiltrated more than 428,000 files from Manage My Health, a widely used private digital health platform. The group reportedly provided downloadable data samples to prove it had gained access to the system.

Manage My Health is a secure online portal and mobile application used across New Zealand, allowing patients to view medical records, book appointments with doctors, and manage hospital visits. The platform stores sensitive health data and personal information, including phone numbers and home addresses, for around 1.8 million users nationwide.

According to estimates released by the platform, the attackers accessed records linked to roughly 6 to 7 percent of its user base. The hackers initially demanded a ransom of 60,000 US dollars to prevent the disclosure or sale of the stolen medical data.

Local media reported that the ransom deadline was later postponed to early Friday morning New Zealand time. The hackers stated that their aim was to generate financial gain while establishing credibility within cybercrime circles.

Manage My Health said that appointment schedules and prescription information were not affected by the breach. In a statement issued Tuesday, the company confirmed it had identified affected patients and notified them of the incident, but declined to comment on the ransom demand.

New Zealand Health Minister Simeon Brown announced the launch of a formal investigation into the cyberattack, stressing the need to draw lessons from the breach to strengthen data protection and prevent similar incidents in the future.

The case has renewed concerns over digital health security in New Zealand, as cyber threats increasingly target medical platforms holding highly sensitive personal and clinical information.