NZ's health data hack needs a proper diagnosis - and a transparent treatment plan - ArkforgeAI.com

By Dylan A Mordaunt* of Photo: RNZ / Finn Blackwell Analysis: Two cyber hacks have highlighted the vulnerability of New Zealand's digital health systems - and the vast volumes of patient data we rely on them to protect. Following the hacking of Manage My Health - compromising the records of about 127,000 patients - and an earlier breach at Canopy Health, a concerned public is asking how this happened and who is to blame. The most urgent question, however, is whether it can happen again. What we know so far Manage My Health (MMH) - a patient portal used by many general practices to share test results, prescriptions and messages - published its first public notice about a cyber security incident on New Year's Day. According to the company, it became aware of unauthorised access on 30 December, after being alerted by a partner. It says it immediately engaged independent cyber security specialists and that the compromise was limited to its "Health Documents / My Health Documents" module. The Office of the Privacy Commissioner confirmed it was notified on 1 January and later published guidance for those affected. The National Cyber Security Centre also issued an incident notice. MMH has since obtained urgent High Court injunctions that restrain the use or publication of data taken. In its decision, the court described activity patterns consistent with automation, including unusually high-frequency behaviour and repeated access attempts. While this sheds some light on how the hacker operated, it does not establish which specific technical control failed - or where responsibility ultimately lies. We have now also learned that a second provider, Canopy Health, experienced unauthorised access to parts of its administrative systems six months ago, with some patients only being notified this week. Why framing matters When health data is stolen at scale, it might be tempting to frame it as "cyberterrorism". That term, however, has a specific and contested meaning. Security scholar Dorothy Denning's widely-cited definition limits cyberterrorism to attacks intended to coerce or intimidate in pursuit of political goals, and which cause severe harm - not financially motivated intrusions or large-scale data theft alone. By that standard, the MMH incident does not clearly qualify. Why does the label matter? Because the way breaches are framed shapes the response. Casting an incident as "cyberterror" can privilege speed over evidence, and dramatic reassurance over careful diagnosis. It can also encourage what critics describe as "security theatre": visible but poorly targeted measures that look decisive without necessarily reducing risk. Research on cyber-threat politics shows that threat narratives influence which problems receive funding, which solutions are prioritised and which questions are ultimately sidelined. So far, the government's response has centred on commissioning a review. In announcing it, Health Minister Simeon Brown framed MMH as a privately operated portal used by some general practices, and asked the Ministry of Health to review the response by MMH and Health New Zealand. That approach makes sense from a stewardship perspective. But it also creates an immediate transparency problem. If government agencies are part of the system response, a ministry-led review can look like "marking our own homework" unless the terms of reference and independence are explicit. At minimum, the review needs a transparent method, a clear boundary between facts and assumptions and a public explanation of what evidence will be examined. An obvious starting point is clarifying who holds the data and who is accountable. MMH's privacy statement and terms of use outline how information is made available through the portal and the responsibilities of users. But public sources do not fully set out the underlying hosting arrangements, the role of subcontractors, or how responsibility is allocated between different parties. Without a clear "data custody chain", accountability becomes diffuse. Photo: SCREENSHOT / RNZ What real fixes look like Offering advice to users - such as that around unique passwords, multi-factor authentication and phishing - may be important, but it is only the baseline. Preventing a repeat of the MMH breach really depends on controls that operate at system level and can be independently audited. First, portal operators should maintain a credible vulnerability-disclosure programme that publicly sets out how security issues can be reported, responded to and tracked. Second, independent testing must be anchored to explicit standards, not general assurances that a system has been externally checked. Third, governance needs teeth. Procurement contracts should require proof that basic controls are in place, along with clear timelines for responding to incidents and preserving evidence. A national framework can help here - and New Zealand's health agencies already publish their own...

NZ's health data hack needs a proper diagnosis - and a transparent treatment plan

Continue Reading on RNZ

How do you feel about this article?

📝 Article Information

Author

Original Publisher

Published Date

Disclaimer