‘One part terrified, one part really angry’ - Assault victim’s anger over Manage My Health hack

Thousands of documents have been caught up in the Manage My Health hack. Photo / RNZ, Finn Blackwell

By Lauren Crimp of RNZ

A sexual assault victim is fearful and “ragingly angry” that her most private information could be made public in the Manage My Health hack.

Hackers are threatening to release more than 400,000 documents stolen from the online portal if the company doesn’t pay the US$60,000 ransom, with a reported deadline of Friday morning.

Manage My Health has identified general practices whose patients have been affected, but it is not yet clear when those people will be informed.

A woman who was sexually assaulted 15 years ago, whom RNZ has agreed not to name, said she had not told some of those closest to her what had happened to her.

She was fearful the information would be leaked.

“It’s almost like I’ve been re-victimised again because I don’t know what’s happening, I’ve got no control over the information,” she said.

“I haven’t even been told if my records have been compromised ... it’s really hard, to be honest.”

The woman was furious with Manage My Health, saying the company had “ruptured” her sense of trust.

“I’m one part terrified, one part really angry, like ragingly angry.

“I’ve given you information to look after so that you can provide health services to me and they’ve failed to keep up their end of the promise.”

In an interview with RNZ yesterday, Manage My Health CEO Vino Ramayah said Manage My Health was itself also the victim of crime.

He said patients should trust the company “even though we have dropped the ball”.

Ramayah told RNZ he personally was aggrieved and distressed by the breach.

His own medical records were among those impacted, he said.

“And so is lots of my friends and families. I am deeply distressed that this is out there and this has happened.”

“The doctor - patient relationship was sacrosanct.”

For the sexual assault victim, the possibility that information about her assault may have been stolen had brought back post-traumatic stress symptoms “with a vengeance” she said.

“My sleep’s interrupted, the flashbacks are back ... and I was doing so well.”

The woman said she’d been caught up in data breaches before, including a copy of her driver’s licence being published online, as well as her address, date of birth and phone number.

She wanted Manage My Health to tell the people whose information was stolen, including exactly what data it is, so they could take precautionary steps.

Manage My Health has apologised for any pain and anxiety the breach has caused, and acknowledged it could have communicated better.

Ramayah said the company has been working hard to make amends.

“I think the main point is there has been a crime, we have tried to do our best, as you know, we’ve had staff working around the clock since this incident with very little sleep and we are trying our best to contain the damage and the pain and anxiety patients feel – that is pretty hard for us as an organisation.”

Online safety advocate Netsafe is warning people to be extra cautious with emails they receive including their private information – particularly if they are threatening or applying any pressure for a response, further information or payment.