Hackers Demand KSh7.7M After Breaching New Zealand Health Data

New Zealand authorities are scrambling to contain a significant cyber breach after hackers claimed access to sensitive health records belonging to tens of thousands of citizens, triggering a national review of digital health security.

The breach, which targeted the privately owned Manage My Health platform, has raised concerns about the vulnerability of patient data stored online.

The attackers, operating under the Telegram alias “Kazu,” have demanded a ransom of about KSh.7.7 million, warning that failure to pay would result in the public release or sale of the stolen files.

The demand has intensified anxiety among users of the platform, which is widely used across the country to store personal medical information.

While the company has not publicly confirmed negotiations with the hackers, the ransom deadline was extended, buying authorities and the firm more time to respond.

New Zealand officials have so far declined to identify any suspects, as investigations into the source and scale of the breach continue.

Scale of the Breach Raises Alarm

Manage My Health revealed that between six and seven percent of its 1.8 million users in New Zealand may have been affected.

The breach was discovered on December 30 after the company was alerted by what it described as a “partner,” prompting an internal investigation.

The hackers have claimed access to more than 428,000 files, even offering sample data for download to prove their claims.

“We know exactly how valuable health data is and how sensitive it can be,” the group said in a Telegram post, underscoring the seriousness of the threat.

Also Read: SHA Invites Overseas Healthcare Providers to Offer Specialized Services to Kenyans

Hackers Frame Attack as ‘Business’

In a move that has baffled cybersecurity experts, “Kazu” insisted the breach was not politically motivated.

“We are doing this as a business. Our main goal is money and building a good reputation in the community,” the hackers wrote, portraying the operation as a commercial enterprise rather than activism.

The group initially set a Tuesday, January 6, 2025, deadline for payment of US$60,000(approximately Ksh. 7.7 million), but later confirmed to local media (The Post) that it had postponed the ultimatum to early Friday, January 9, 2025, morning.

The same Telegram account also posted unrelated political messages, including a statement reading “free Nicolas Maduro,” further complicating assessments of the group’s motives.

Also Read: Duale Reveals Which Kenyan Health Data Will Be Shared with the U.S. and Why

Government Steps In

Health Minister Simeon Brown on Monday, January 5, 2025, ordered an urgent review into how Manage My Health handled the incident.

“I know this breach will be very concerning to the many New Zealanders who use ManageMyHealth, and we need assurances around the protection and security of people’s health data,” Brown said.

He added, “We must learn from this incident to avoid any repeat events in the future,” signaling potential regulatory or policy changes aimed at strengthening data protection standards across the health sector.

Company Response and Patient Notifications

Manage My Health said, “the compromised data included personal details such as names, phone numbers, and addresses,” but further stressed that, “appointment schedules and prescription information were not affected.”

In a statement, the company confirmed that, “we have identified all patients whose documents may have been accessed and have begun notifying them in phases.”

Follow our WhatsApp Channel and WhatsApp Community for instant news updates

An illustration photo from Cyber Management Alliance. PHOTO/ File