ManageMyHealth disclosed on 1 January 2026 that unauthorized access had exposed medical documents linked to approximately 120,000–127,000 patients, or 6–7% of its reported 1.8 million registered users. The compromised material was held in a document-storage module and included specialist referrals, hospital discharge summaries, laboratory and imaging reports, clinical correspondence, and patient-uploaded files; media reports said more than 400,000 documents, some dating from 2017–2019, were exfiltrated. ManageMyHealth said its core patient database and national clinical systems were not accessed, and that there was no evidence of altered or destroyed data.
A group calling itself Kazu demanded US$60,000 and published samples of the stolen records. On 5 January 2026, the High Court granted interim injunctions prohibiting publication or distribution and ordered anyone holding the information to delete it. The company faced criticism over delayed or inconsistent notifications, access problems, and CEO Vino Ramayah’s disputed description of the intrusion as occurring through the “front door” with valid credentials. Health Minister Simeon Brown ordered an urgent review, while Privacy Commissioner Michael Webster opened an investigation on 21 January into whether ManageMyHealth’s safeguards were adequate and how to prevent recurrence.
