A victim of the ManageMyHealth cyber attack is horrified to see most of her documents stored on the portal have gone missing. 

Not only was she just informed by ManageMyHealth that her data had been compromised in the breach, but about 100 of her medical records stored on the platform have vanished. All but 16 are gone. 

The woman, who will be referred to as Jane to protect her privacy, has a web of chronic health conditions, so relies on the portal to get her test results quickly and ensure records from the various parts of the health system she engages with are consolidated in one place. 

She is also nervously awaiting results of a brain scan and is due to have a hysterectomy. 

“It’s so f****** horrible. It’s so invasive,” Jane said of the situation. 

“Out there somewhere is personal information that my family doesn’t even know.” 

She noted she had been so cautious of sharing her personal information, she didn’t even have internet banking. 

“There is a reason I don’t have apps on my phone, but they told me I could trust it [ManageMyHealth],” she said. 

“Doctors can’t be touting stuff if they’re not certain it’s safe. They’re supposed to be people who people can rely on.” 

Jane is one of about 127,000 people whose health records have been compromised in the attack, which ManageMyHealth became aware of on December 30. 

• Leaking of personal details a concern for victim of Manage My Health breach
• 45 GP practices affected by Manage My Health cyber hack identified in one region
• Manage My Health hackers remove information about data online

The attacker allegedly demanded the company pays a US$60,000 ($104,000) ransom by 5am today to avoid the data being distributed. 

ManageMyHealth is issuing daily updates, but is declining to answer the Herald’s questions, including around what’s happened to Jane’s documents, whether it’s negotiating with the hacker, and whether it’s been audited by a government entity. 

The portal, which has 1.85 million users in New Zealand, works in conjunction with one of the two main operating systems GP clinics use. Medical practitioners use it to share information with their patients – including notes from appointments, test results and prescription information. 

Jane believed personal health-related photos were among the documents that have now disappeared from the portal. 

Some data breach victims have heard from their clinics, but not ManageMyHealth. However, Jane had only heard from the latter. 

She was incensed by its communications ironically being headed, “private and confidential”. 

Jane hadn’t contacted ManageMyHealth to ask where her documents had gone. 

The Herald has heard a report of the 0800 number ManageMyHealth has given victims being clogged and not connecting to an operator. 

“I don’t trust them,” Jane said. 

“They’re going to cover their asses … They’re in PR mode.” 

ManageMyHealth hasn’t said anything in its daily updates about people’s files going missing. 

On Thursday, it said it was still in the process of contacting those whose data had been breached. 

“The issue now is, who’s going to take accountability?” Jane questioned. 

Health Minister Simeon Brown has distanced the Government from the saga, saying ManageMyHealth was responsible for keeping the data safe. 

He directed the Ministry of Health to do a review in the wake of the breach. 

The Office of the Privacy Commissioner wants the Privacy Act to be strengthened, as there is no civil penalty regime for organisations that fail to protect personal information. 

Health New Zealand hasn’t responded to the Herald’s questions about the oversight it has of companies like ManageMyHealth that provide key services to the health sector. 

Health New Zealand issues providers with detailed IT guidelines, but hasn’t told the Herald if it has audited ManageMyHealth. 

In terms of accountability provided by ManageMyHealth’s governance structure, it only has two directors, one of whom is its chief executive and sole owner (via another company) – Vino Ramayah. 

It is establishing an advisory board to provide it with support in the wake of the attack. 

Jenée Tibshraeny is the Herald’s Wellington business editor, based in the parliamentary press gallery. She specialises in government and Reserve Bank policymaking, economics and banking.