The Prime Minister is concerned after a second major medical platform hack, leaving live patients labelled as dead, and people’s names changed to “Charlie Kirk”.
MediMap is widely used across New Zealand and is often used by the aged care, disability, hospice and community health sectors.
This is the second major cyber attack on medical files and records in recent weeks, after Manage My Health was hit.
Manage My Health’s health portal systems were compromised over the New Year holiday, putting the data of over 120,000 users at risk.
Prime Minister Christopher Luxon said he was aware of the situation this afternoon and called it “concerning”.
“It’s concerning, particularly when it follows Manage My Health. It’s a reason for why I’ve been advocating very strongly that we need to strengthen our cyber security laws here in New Zealand,” Luxon said.
Associate Health Minister and Deputy Prime Minister David Seymour said the latest health data breach “will be distressing for people”.
Seymour said the exact number of people affected is still to be determined.
“Clearly this will be very distressing for a lot of people who have parents and elderly people in retirement villages and care settings,” he said.
Seymour said incidents like these are happening all over the world, and “New Zealand cannot afford to be the weakest link”.
Health New Zealand Digital Services acting chief information technology officer Darren Douglass said as a private company, MediMap is solely responsible for ensuring the security of its platform.
Douglass said it is also MediMap’s responsibility to do everything it can to manage this incident and minimise any potential impact.
In a statement, MediMap director Geoffrey Sayer confirmed “unauthorised activity” caused some patients’ demographic records to be incorrectly changed.
Sayer said that as soon as they became aware of the issue, they took several actions.
“We engaged specialist external cyber experts and placed the platform into maintenance mode as a precautionary measure to protect patient safety.
“Our focus is on helping facilities to provide continuation of care, and then on remediation and safe restoration,” Sayer said.
Sayer said customers have since reverted to their standard alternative manual processes to ensure patients could continue to receive the required levels of care.
“Our preliminary investigation indicates that the incident has affected certain demographic information, such as resident name, date of birth, assigned prescriber, location of care and resident status,” Sayer said.
He said Health NZ is in contact with MediMap to provide support and understand the scope of the issue.
MediMap has notified the Office of the Privacy Commissioner and NZ Police.
“We understand our platform is critical to aged care and healthcare across New Zealand, and we sincerely apologise for the disruption and concern this situation has caused,” Sayer said.
When the Herald first attempted to contact MediMap, a pre-recorded message said the team was currently investigating the issue.
“MediMap is currently experiencing an issue raised Sunday, February 22 ... Due to this, MediMap is currently unavailable,” the message said.
A registered nurse told Stuff that their medical facility had been affected.
“When I searched for one of the missing patients using their NHI number, I located the profile and observed that the patient had been incorrectly marked as deceased,” the nurse said.
After contacting support, more irregularities were discovered.
“More patients were marked as deceased, names appeared to have been changed to Charlie Kirk, ages were altered, and some patients were assigned to different facilities,” the nurse told Stuff.
MediMap is primarily used by private aged-care providers, pharmacies and GPs.
A source close to the company told the Herald that MediMap also integrates with the public healthcare system for NHI (National Healthcare Index) numbers, used to identify patients.
“Our seamless integration with the National Health Index (NHI) database allows you to access and update patient information quickly and accurately,” MediMap’s website said.
Christchurch-based MediMap was founded in 2012 by pharmacist Greg Garratt, who has since retired.
Garratt founded the business after he became frustrated with faxes and other paper-based systems.
In 2023, it merged with Australian firm Z Software, a maker of healthcare software.
The MediMap incident follows a breach at New Zealand’s largest private oncology provider, Canopy Healthcare, in July last year.
Some patients were not informed until last month.
It also comes after the sweeping ManageMyHealth breach at the end of December involving more than 120,000 records.
This breach is now the subject of investigations by the Ministry of Health and the Privacy Commissioner.
Luxon said New Zealand’s business environment was “way too laidback”.
He said that, in 2026, risks and threats were not being taken seriously enough sometimes.
Sign up to The Daily H, a free newsletter curated by our editors and delivered straight to your inbox every weekday.