Manage My Health cyber attack: Patients to start getting breach emails

Manage My Health plans to start notifying patients affected by the cyber attack. Photo / Michael Craig

The medical portal caught up in a cyber attack says it is starting to contact patients whose documents were stolen.

About 430,000 patient documents, some dating back to 2017, were stolen in the attack in which a US$60,000 ($103,709) ransom was demanded.

Court documents revealed the data breach included information from 45 GP practices based in Northland.

Manage My Health has not publicly stated which GPs have been impacted, and the Northern Advocate was able to identify only a small number affected.

However, Manage My Health last night said the company would begin notifying patients in the next 24 hours.

" ... We hope to complete this process by early next week."

Manage My Health said notifications would be sent initially through email to the address used to register the account.

The notifications will include an 0800 number that people can call to seek support or help if needed.

The Manage My Health mobile app has been redirected to the Manage My Health web application, so notifications are consistent across platforms.

Visitors to the Manage My Health app will see a pop-up notification alerting them to the redirection.

“This is intentional,” Manage My Health said. “The mobile app will be restored in time, and users will be notified of this.”

The company was liaising with Health New Zealand, the Office of the Privacy Commissioner, General Practice New Zealand and GP clinics to ensure clear, consistent information was received by patients.

Until yesterday, some Northland GPs had criticised Manage My Health for what they called a lack of communication.

Kensington Health practice manager Darren Rowbotham said he had received no official information about the number of patients impacted, nor how they would be contacted, what information would be disclosed and what support would be offered.

While Manage My Health had created a data breach report within the portal, he said, the number of affected patients kept changing, and he did not know which – if any – was correct.

Manage My Health said it was working around the clock to respond to the unprecedented criminal cyber attack.

“We sincerely apologise for the pain and disruption that this incident has caused to our providers and patients as a result of this criminal activity against our systems.”

Health Minister Simeon Brown acknowledged the breach was concerning to the many people who used the privately operated patient portal.

“Patient data is incredibly personal, and whether it is held by a public agency or a private company, it must be protected to the highest standards,” he said.

Brown, who has ordered an urgent review into the breach, was pleased the company was starting to contact affected patients.

“It is my expectation that Manage My Health works quickly to ensure all impacted patients are contacted as soon as possible,” he said.

“Health NZ is also working closely with Manage My Health to ensure this happens as accurately and quickly as possible.”

The Privacy Commissioner has stressed that Manage My Health is responsible for notifying impacted users directly and supporting them through the process.

The information taken included clinical discharge summaries, referrals and related files, and information uploaded to the system by patients. Some of it covered historical clinical referral records dating from between 2017 and 2019.

Manage My Health was granted a High Court injunction on Tuesday night preventing anyone from accessing or sharing the stolen data.

By yesterday morning, all posts referring to the Manage My Health hack had been removed from an account purporting to be used by the hacker Kazu.

Anyone in possession of the information was required to delete it.