ManageMyHealth - New Zealand Listed by kazu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The ManageMyHealth incident was reported on December 30, 2025, when the kazu ransomware group listed the New Zealand online health platform on its leak site. Public information states that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and no further technical details have been released. Health platforms hold sensitive records that can affect individuals long after an incident becomes public, which places this event in the broader pattern of ransomware operations targeting sectors that store personal and medical data.

Inside the incident

According to the available report, ManageMyHealth suffered a ransomware attack in which internal files were removed from its systems. The kazu group claims responsibility by listing the organisation on its leak site. No confirmation of the volume of data, the method of initial access, or whether any data was later published has been made public. The number of individuals whose information may be involved is also undisclosed.

Inside kazu

Kazu is a ransomware operation that follows the common pattern of encrypting systems and removing copies of data before demanding payment. Such groups typically maintain leak sites where they list organisations that have not met their demands, using the listing itself as leverage. Public reporting on the group shows activity against entities in multiple countries and sectors, with the same exfiltration-plus-leak tactic observed in other incidents. The listing of ManageMyHealth constitutes the group’s claim; independent verification of the data’s contents or publication status has not been reported.

Who is ManageMyHealth?

ManageMyHealth is a New Zealand-based online platform that gives users secure access to their medical records and a channel for communicating with healthcare providers. The service supports viewing test results, managing prescriptions, scheduling appointments, and tracking health history across devices. Organisations of this type routinely process personal identifiers, clinical information, and communications between patients and clinicians, making them repositories of data that individuals expect to remain private.

The information in question

The only detail released states that internal files were exfiltrated. No inventory of specific data fields has been published. Organisations that operate patient portals commonly store names, contact details, medical history, test results, prescription records, and appointment information, yet the precise contents of the files taken in this case remain unconfirmed.

What's at stake

Exfiltrated internal files from a health platform can contain records that individuals rely on for ongoing care and that may be difficult to change. For the organisation, the incident brings operational disruption, potential regulatory scrutiny under New Zealand privacy rules, and the need to review access controls and incident response procedures. Affected people face the possibility that their information could be used for targeted fraud or unwanted contact, though the actual use of any data is not known at this stage.

Were you affected?

Individuals who use ManageMyHealth can begin by contacting the service directly for any notifications it may issue. Monitoring bank and medical accounts for unusual activity provides a practical early check. Running a free exposure scan of your email address against known breach data sets can indicate whether your information has appeared in previously published collections.

• Contact ManageMyHealth support for account-specific guidance.
• Review statements from banks, insurers, and healthcare providers.
• Use a reputable breach-checking service to scan your email.
• Enable multi-factor authentication on any linked accounts.

AICompiled with AI assistance from public sources and published under our editorial standards.