Hackers claiming to have accessed more than 100,000 health records in New Zealand have reportedly extended their ransom deadline to Friday, citing a desire to build a “good reputation” in the cybercriminal community.
The privately owned Manage My Health platform confirmed that cybercriminals accessed the records of approximately six to seven percent of its 1.8 million users nationwide.
Authorities have not publicly identified the suspects behind the breach, which Manage My Health discovered on December 30 after being alerted by a partner.
A Telegram user operating under the name “Kazu” has claimed responsibility, stating that they accessed over 428,000 files on the platform and provided sample documents for download. According to Kazu, the initial ransom demand was US$60,000 (around Ksh.7,737,000), with a Tuesday morning deadline to prevent the release or sale of the stolen data.
New Zealand media outlet The Post reported on Tuesday that the hackers had confirmed the ransom deadline had been extended to 5:00 am Friday (1600 GMT Thursday). In a previous Telegram post, Kazu clarified that the group is not politically motivated, stating:
“We know exactly how valuable health data is and how sensitive it can be. We are doing this as a business. Our main goal is money and building a good reputation in the community.”
The group also made a separate reference to the US capture of Venezuela’s president, saying: “free Nicolas Maduro.”
Manage My Health stores patient medical records and personal information, including phone numbers and addresses. The company has confirmed that appointment and prescription data were not affected by the breach.
In a statement on Tuesday, the firm said it had identified all patients whose documents may have been compromised, with the first notifications already sent. The company did not provide further updates on ransom demands or the revised deadline.
New Zealand Health Minister Simeon Brown announced a review of Manage My Health’s response on Monday. He emphasized the importance of data security for patients, saying:
“I know this breach will be very concerning to the many New Zealanders who use Manage My Health, and we need assurances around the protection and security of people’s health data. We must learn from this incident to avoid any repeat events in the future.”
