Manage My Health, a portal enabling connection between individuals and their healthcare providers, experienced a cyberattack identified on Dec. 30. The New Zealand-based organization published a statement to its website the following day, and as of Jan. 5, has continued to post subsequent updates as information has come available. 

Following the forensic investigations, the organization believes around 7% of 1.8 million registered patients may have been impacted. 

While it appears that hackers were able to access a specific collection of documents within the organization’s system, it does not appear that they accessed the main patient database or any credentials. Moreover, no evidence has been found to suggest that data was modified or destroyed. 

According to RNZ, on Jan. 4, cybercriminals calling themselves Kazu claimed the attack and asserted that “unless the company paid a ransom within 48 hours, they would leak more than 400,000 files in their possession.” 

Furthermore, some have criticized the organization’s response, pointing to a lack of communication as an issue. 

“We acknowledge we could have done a better job at communication, however, our priority was to secure patient data and work on the accuracy of all information before providing it to practices and patients. This has been our paramount consideration,” Manage My Health said in a statement on its website. “As we have said from the beginning, we strive to be transparent in our communications, and will be publishing daily updates with all the information we can share with you. There are constraints, both legal and practical to the fast dissemination of this information.” 

The organization states it is moving forward with informing affected practices and patients. 

“We acknowledge that this delay has been a cause for concern,” the company says. “We will make every effort to continue to work hard to provide you with accurate and reliable information as urgently as practicable, in consultation with various stakeholders.” 

Direct communication with affected practices will commence this week, and will continue until all are notified. Additionally, regular updates will continue on the website as long as information is available and appropriate to share.