Folks,
I’ve been travelling to New Zealand for years. It’s one of the last places on earth that still feels like a natural paradise. It’s clean, remote enough, and small enough that it could actually matter if everything elsewhere went sideways. If the worst happened, it’s a place that might still be able to feed itself and keep the lights on. That’s why I pay attention when things start going wrong with the systems that run the country.
Right now New Zealand votes on 7 November. Polls are tight. The latest 1News–Verian poll has National and Labour level on 28% each. Everyone’s talking about the cost of living and housing, which is fair. Almost nobody is talking about the fact that the same government pushing digital driver’s licences and a trial of passport-free travel across the Tasman spent the better part of last year sitting on clear warnings that one of the country’s main patient portals had a password problem.
That’s not a theory. It’s what the emails show. And now the official reviews say it too.
What the emails show
On 22 June 2025, a source using the handle FVEY25 sent a security report titled “Manage My Health App Data Concerns.” It was 3:15 PM in Washington and 7:15 AM on 23 June in New Zealand. The report went to Manage My Health (MMH) support and to the Office of the Privacy Commissioner (OPC). It was blind-copied to a personal Gmail address that our source says belongs to Prime Minister Christopher Luxon. He never replied.
The report said patients’ email addresses and passwords were sitting in the open, indexed by an OSINT search engine and attached to MMH web addresses. It came with a 3-page incident report and a 52-page list. In the source’s words:
“These records have not come from a ‘phishing’ site, but from the authentic website in question. … immediate action is recommended to mitigate risks, including a forensic investigation, user notification, and enhanced security controls. This report is submitted within the 72-hour regulatory deadline under the Privacy Act 2020.”
MMH’s system answered within two minutes: “Your case number is CAS-2592268.” Eight hours later, the source resent the report to 40 separate Privacy Commissioner addresses. The OPC’s auto-reply warned that it “will not respond to emails not addressed to us or that we are only copied into.”
Seventeen days later, the OPC opened file PBN/4009. Its first question wasn’t about the passwords. It was about money: “My read of the submission is financial details aren’t/weren’t directly affected – is that correct please?” The source answered that it was “user email addresses, passwords (many could be used elsewhere) full names and other PII — all of which are just (if not more) disastrous as exposed financial records.”
Then basically nothing useful happened for months.
The source kept going. In August he wrote to Stuff’s tips desk: “as of 5:19pm ET this data concern is still a major concern.” On 2 October he copied 98 addresses at Newstalk ZB and wrote separately to Winston Peters. On 5 October he sent a spreadsheet he said showed a separate Health NZ misconfiguration exposing Auckland DHB staff logins, and copied the Privacy Commissioner’s officer. On 20 October the OPC replied that it was “assessing what you’ve told us, and whether any change is required to our compliance approach.”
In between, on 1 October 2025, we published it. Part 1 of our digital ID series told readers that a Manage My Health security problem had been reported to New Zealand officials on 22 June and had “yet to be publicly acknowledged.” That was three months before anyone in New Zealand officially “discovered” anything.
On 4 November the source asked MMH directly: “What are you guys doing to fix this?” The answer finally came on 5 November 2025, about four and a half months after case CAS-2592268 was opened. It didn’t come from the CEO or a security lead. It came from MMH’s Customer Care Manager:
“Following our analysis, we sent an email notification to the impacted users, instructing them to reset their Manage My Health passwords immediately. … We have enabled 2FA for all impacted users. … We have also submitted a Privacy Breach Notification Form through the Privacy Commissioner’s website.”
Only “the impacted users.” Everyone else stayed on a single password. The source’s reply was blunt: “So you did not inform ALL clients just the ones you think were affected? That is not good enough.”
He was right, and now the Privacy Commissioner agrees with him. More on that below.
The media fared no better. On 21 November, Stuff’s investigations desk wrote back: “I’ll get someone from the team to contact you.” Internally, someone forwarded it on as “Another possible story here.” Nobody called. On 13 January 2026, after the breach was front-page news, Stuff investigative reporter Isaac Davison put it plainly:
“Yes it’s unfortunate we didn’t take a look when you contacted us the first time.”
Then came December
On or around 21 December 2025, a hacker calling himself Kazu logged into Manage My Health with a real patient’s username and password. He then used a weakness in the portal to move from that one account into thousands of other patients’ files, over several days. On 29 December a sample went up on a dark-web leak site. On 30 December the data was advertised for sale. That evening, Health NZ, not MMH, spotted it and raised the alarm. Kazu demanded US$60,000. MMH obtained a High Court injunction on 5 January.
The files came from the “My Health Documents” section. They included hospital discharge summaries, specialist referrals, lab results and user-uploaded files. The hacker claimed 428,337 files and 108GB. The confirmed toll is 99,416 people, revised down from early estimates of around 126,000. Roughly 91 percent of them were Northland patients. Media reports based on the published samples described clinical notes, intimate images and scanned passports. These are the kinds of files that invite targeted extortion, not just general identity theft.
Only after the breach did the June warning surface. On 7 January, Deputy Privacy Commissioner Liz MacPherson confirmed to BusinessDesk that her office had received the anonymous email in June 2025. She said the OPC had advised MMH to “consider” applying extra protections across all accounts. On 9 January, MMH said it had “investigated and did not find any breach,” but had “out of an abundance of caution … forced password resets on the users concerned” and “reinforced that two factor authentication is available.”
That is not quite what MMH told our source in November. Back then it said it had required two-factor authentication for the affected users and had filed a privacy breach notification. MMH should explain the difference.
The same week, our source wrote to Health Minister Simeon Brown, copying MMH and the OPC. Brown replied on 9 January (NZ time):
“I am deeply concerned and disappointed by this breach of confidential patient information … That has clearly not happened in this case which is why I have ordered a review of what has happened and the response to it, and how any repeat can be avoided. The information you provided has been forwarded to relevant parties for consideration.”
We published Part 5, The ‘Manage My Health’ Cover-Up, that same day.
What the official reviews found
This is the part the campaigns would prefer you skip.
In May 2026, Privacy Commissioner Michael Webster released Phase 1 of his inquiry. It found that both MMH and Health NZ breached Rule 5 of the Health Information Privacy Code, the rule on keeping health information secure. Paragraph 211 of his report says this:
“At the time of the incident, MFA was not enforced for end-user accounts, despite this being noted as a risk both in MMH’s own privacy risk assessments and by the Northland project team. While 2FA or MFA capabilities were available, their use was optional … This was despite the fact that, prior to the incident, there had been indicators of potential valid user credential exposure (such as a reported incident in June 2025).”
That’s the regulator, in its own report, pointing to the June 2025 warning. Why did MMH keep MFA optional? According to the report, because of its “perception that patients did not like it.” Mandatory two-step verification arrived in January 2026, after 99,416 people had already had their documents taken.
The Ministry of Health’s review, informed by CyberCX and Bastion Security Group, went further. It called the breach “largely preventable” and made 26 recommendations. CyberCX found that the login Kazu used had been stolen by infostealer malware called Lumma Stealer. Its verdict: “This type of attack is neither technically sophisticated, nor particularly uncommon.”
And there was a second warning. On 17 November 2025, an independent security researcher’s report on flaws in MMH’s API reached the company via the Ministry of Health. That researcher is not our source, and had first flagged problems back in December 2022. CyberCX said the flaws had “enough similarities to the attack method … to have raised serious concerns with MMH and should have prompted rapid remediation.” It found “no evidence” they were fixed before Kazu walked in five weeks later.
So that’s three warnings: December 2022, June 2025 and November 2025.
In September 2026, Webster issued formal compliance notices to both organisations, his strongest tool. They set legally binding deadlines: Health NZ by 29 January 2027, MMH by 31 August 2027. The Northland concentration came from a project between the old Northland DHB, now Health NZ, and MMH. It started around 2019, was piloted in 2021, and was rolled out more widely between 2023 and 2025. That project funnelled public hospital records into a private portal. Near its end, Health NZ’s business owner “formally accepted the risk” of running without MFA.
A fair objection, and why it makes the case stronger
Some New Zealand commentators have argued that the June 2025 list proved nothing. They point out that the email and password pairs look like old, recycled breach data bolted onto MMH web addresses, and that the 3-page report reads like boilerplate. Fair enough. The list didn’t show that MMH’s servers had been hacked, and we’ve never needed it to.
What it showed was that MMH patients’ logins were out there, circulating. That is “credential exposure,” in the Privacy Commissioner’s words. It’s exactly the risk that mandatory multi-factor authentication exists to stop, and exactly how Kazu got in: one valid stolen password, no second factor, and then the run of the house. Whether the June list and the December login were the same hole or two symptoms of the same weak system, the practical result for patients was the same. Their information was taken. The timeline of warnings was downplayed. Trust was burned.
Now look at what else is moving over there
Legislation is already through for optional digital driver’s licences. The Regulatory Systems (Transport) Amendment Act passed in May 2026. You scan your physical card, complete a facial check against the register, and receive a version stored on your phone. NZTA is pointing to the second half of 2027. The government wallet and NZ Verify are expanding so more credentials can live on the device.
On 1 October, Christopher Luxon himself announced National’s election policy for a trial of “paperless” travel to Australia before the 2028 T20 World Cup. Eligible citizens would pre-submit their passport details on a phone, then move through Auckland, Wellington, Christchurch and Queenstown airports using “a smartphone, their digital credentials and biometric technology.” Australia has to agree. Biosecurity stays. The physical passport still exists somewhere, but the pitch is smoother, phone-based movement.
These systems sound convenient until you remember what just happened with a health portal used by about 1.8 million people. Optional security features stayed optional. A warning that went to the company, the regulator, dozens of journalists and, by our source’s account, the Prime Minister’s own inbox produced no emergency action. When the system was eventually breached, patients found out late. The Ministry’s own reviewers described the notifications as “often confused, overly optimistic and inaccurate.” Health records are already sensitive. Layering biometric enrolment for licences and border functions on top of that same institutional culture is not a small step.
New Zealand as a test population
New Zealand has form as a test population for this kind of technology. EFTPOS arrived there early, piloted at Shell and other service stations in 1985, and Kiwis adopted it faster and more completely than most places. It worked. It also meant the problems showed up there first. Digital health has followed a similar path. Manage My Health became the default portal for most GP practices, with more than 680 health centres. A specific regional deal concentrated more sensitive public hospital documents into one private system. The same pattern is now being applied to identity and travel documents. Early and enthusiastic rollout in a small, connected country means the failures surface there first too.
I’ve spent enough time in the country, and enough time dealing with its institutions from the outside (including helping a friend of mine, Kim Dotcom, navigate the machinery of the New Zealand state), to know that competence and candour are not automatic. They have to be insisted on.
Why this matters on 7 November
Voters over there have three weeks left to decide whether any of this matters to them. Most of the campaign will be about groceries and rents. Fair enough. But the people who will be asked to put their face into a digital licence system, or to cross the Tasman on a phone credential, deserve a straight answer about the last time a major government-linked digital system was warned about credential problems, by a whistleblower, a researcher and its own risk assessments, and did very little for half a year.
Ask the candidates:
Why did a June 2025 warning, sent to MMH, the Privacy Commissioner and, by our source’s account, the Prime Minister’s personal inbox, produce only limited password resets instead of mandatory MFA, the fix the Commissioner later said was overdue?
Why did a second warning about MMH’s API, passed to the company by the Ministry of Health on 17 November 2025, go unfixed until after the theft?
What independent evidence exists that the failures the Privacy Commissioner identified, which a Ministry review called “largely preventable,” have actually been closed? Will the same standard apply to the digital licence and travel systems?
If biometrics are going to be used for licences and airport movement, who holds them, for how long, and who checks the people holding them?
Why should anyone believe the next digital system will be handled better when the last clear warning was effectively ignored for six months?
Northland patients already know what the gap between ambition and competence looks like. Everyone else is about to be offered the same systems with better marketing. The lost six months are not ancient history. They are the clearest recent evidence of how these institutions actually behave when something goes wrong. You can decide that doesn’t matter. You shouldn’t have to decide without being told.
New Zealand still has a chance to get this right. It would be a shame if it didn’t.
Our earlier reporting on this story:
- The Slippery Slope of Mandatory Digital IDs – Part 1: New Zealand (1 Oct 2025)
- Part 2: Australia · Part 3: Canada · Part 4: United Kingdom
- The Slippery Slope of Mandatory Digital IDs is Accelerating (8 Oct 2025)
- The ‘Manage My Health’ Cover-Up: Ignored Warnings, and the Erosion of Trust in Digital Health – Part 5 (9 Jan 2026)
Sources:
- OPC Phase 1 inquiry report (May 2026)
- OPC compliance notices (Sept 2026)
- CyberCX review for the Ministry of Health
- 1News on National’s travel trial
If you have tips on this or similar stories, reach us securely via our whistleblower portal.
~GEORGE and Team