Photo: RNZ/Calvin Samuel
The hacked health portal MediMap needs to be doing everything it can to manage the fallout from being hacked, Health New Zealand says.
It was breached on Sunday and the company has now taken the platform offline while it investigates.
Some users’ information had been changed, including to say they were deceased.
MediMap is used by some health providers in aged care, disability, hospice and the community to accurately record medication doses.
It allows clinics or aged care services to coordinate with people and pharmacies, and can be used for e-prescribing and includes people’s medication histories.
“New Zealanders expect that companies involved in healthcare have secure systems and platforms that safeguard their private information,” Health New Zealand’s Darren Douglass said.
“As a private company, MediMap is solely responsible for ensuring the security of its platform,” he said.
Douglass said Health NZ was supporting MediMap with its response and working with other relevant agencies, including the National Cyber Security Sector.
Health New Zealand itself had activated its Cyber Incident Management Team.
Information sent to clinics from the company said the problem began about 1.30pm on Sunday.
A notification on the company’s website says the company is investigating the scope of the impact and will remain offline while this happens.
An apparent hack of medication platform MediMap has led to some alive patients being marked as deceased.
Photo: SCREENSHOT
MediMap issued a response to RNZ saying it had identified “unauthorised entry” and involved names, dates of birth, prescribers, location of care and resident status.
The platform was being helped by the Ministry of Health, it said.
“As soon as we became aware of the issue, we engaged specialist external cyber experts and placed the platform into maintenance mode as a precautionary measure to protect patient safety. Our focus is on helping facilities to provide continuation of care, and then on remediation and safe restoration,” MediMap director Geoffrey Sayer said.
“Customers have reverted to their standard alternative manual processes to ensure patients continue to receive the required levels of care they should expect.”
Sayer said the Office of the Privacy Commissioner and NZ Police had also been notified.
“We are continuing to investigate the impact on patient data while implementing a safe restoration pathway,” Sayer said.
“We are committed to keeping our all our customers and stakeholders informed as our investigation progresses and will continue to provide updates via our website.
“We understand our platform is critical to aged care and healthcare across New Zealand, and we sincerely apologise for the disruption and concern this situation has caused.”
‘We appreciate today has been challenging’
In an email MediMap sent to users on Monday and seen by RNZ, the company said it appreciated the day had been challenging.
It said the portal remained in “maintenance mode” while an investigation and data checks were ongoing.
“This work is already underway with our team of external specialists,” Sayer said in the email.
“We recognise the pressure this situation is placing on your teams and residents,” he said.
“Thank you for your continued cooperation as we work through this situation with urgency and care.”
MediMap said Sayer was unavailable for interview because he and staff were focused on the investigation.
The Aged Care Association said as many as 60 percent of aged care facilities could be using the app.
Those who did had to switch to paper-based processes.
In an email to health providers, MediMap said the app would remain offline while it investigated and carried out “data integrity checks”.
That would allow them to provide clearer guidance on how they would resolve the problem and how long that would take.
‘Number of hospices’ affected
Hospice New Zealand said a number of hospices were affected by the outage caused by MediMap shutting its portal down as a precaution while investigations are underway.
“But they have contingency plans in place and have switched to alternative prescribing and medication administration systems, primarily this is manual paper-based systems,” chief executive Wayne Naylor said.
“As far as we are aware, patient care has continued safely and has not been impacted greatly by the outage.”
Staff uneasy about precautionary shut down
The Nurses Organisation said it had been told aged care sites across Christchurch were affected.
An anonymous member working at George Manning Lifecare and Village, in a message provided by the union, said the platform’s precautionary shut down was risking patient safety and staff were scared.
“Since MediMap stopped working we have had to double the number of registered nurses on each shift just to give medication, this requires a paper form from the pharmacy, everything from paracetamol through to controlled drugs requires a second checker to observe and sign along with the registered nurse administering,” they said.
“This process makes each medication round longer and means the risk of residents not receiving their medicine on time is high… not being able to access medimap is risking their safety and we do not have a back-up in place to make sure this doesn’t happen again.”
The worker said staff were scared for residents and for themselves.
‘Very distressing for a lot of people’
Prime Minister Christopher Luxon said he was aware of the MediMap breach.
“It’s concerning, particularly when it follows Manage My Health. It’s a reason why I’ve been advocating very strongly that we need to strengthen our cybersecurity laws here in New Zealand and also make sure that we’re not laid back,” Luxon told reporters.
Prime Minister Christopher Luxon said the breach was concerning.
Photo: RNZ / Nathan McKinnon
Associate Health Minister David Seymour said the hack underscored the importance of cybersecurity.
“Clearly, this will be very distressing for a lot of people who have parents and elderly people in retirement villages and care settings, and it reinforces why it’s so important that the government strengthens its work around cybersecurity,” Seymour said.
“This is happening all over the world, and New Zealand cannot afford to be the weakest link.”
He said the government was actively working to improve things.
“New Zealand has been behind other countries for many years on this. Our government is now working very rapidly to keep up and this has been discussed in the highest levels of government as recently as a few weeks ago,” Seymour said.
“So, we’re very aware that this is a challenge. New Zealand has work to do, and it is being done.”
It comes almost two months after privately owned patient portal Manage My Health was caught up in a privacy breach.
On 30 December 2025, a hacker (or group) calling themselves Kazu posted online they had breached Manage My Health. They claimed to have 108GB of data, made up of 428,337 files including names, medical records, test results, prescription details and more. A small sample of data was published as proof.
Kazu demanded US$60,000 (NZ$104,000) as a ransom.
It was one of the biggest privacy breaches in New Zealand history.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
