January 5, 2026 • 7 mins
Manage My Health expects to start working in coming days through notifying people caught up by last week's data breach.
The privately-owned health platform has now identified who's affected.
Health Minister Simeon Brown says it needs to do better at informing the public what's happening.
But he told Andrew Dickens the notification process will be complex and needs to be quick but accurate.
Brown says he's spoken with the Privacy Commissioner about how they'll support that.
LISTEN ABOVE
See omnystudio.com/listener for privacy information.
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:09):
You're listening to a podcast from News Talks be follow
this and our wide range of podcasts now on iHeartRadio.
Speaker 2 (00:16):
Today's day the deadline to pay the ransom to the
hackers who have stolen New Zealander's health data from Manage
my Health. Around one hundred and twenty thousand New Zealander's
most private information is being held for ransom for sixty
thousand US dollars. The company has issued a High Court
injunction to prevent our info being released by the hackers.
(00:37):
Whether they respect that is anybody's guess. They're not in
this country, they're not subject to that law. And Health
Minister Simmy and Brown yesterday announced a review into the
Manage to My Health data leak a leak. Brown has
stated it's the government's longtime position to never pay ransoms
so as not to endorse criminal activity in Simon Brown
joins me, Now, good morning to your minister. Good morning,
(00:59):
it's deadline day. Is anyone talking to the hackers at all?
Speaker 3 (01:04):
Look, there's a Hall of Government Incident Manager team that's
been established. It has a range of players involved, including
the National Cybersecurity Center, police, et cetera. Look, they are
very focused on supporting manage my health as much as
we can.
Speaker 2 (01:23):
But are they talking to the hackers though.
Speaker 3 (01:26):
Ultimately those questions should be put to them. In regards
to the work that they're doing. There's a lot of
forensic work underway. I'm not going to get into the detail.
Speaker 2 (01:34):
So if the deadline happened, if the deadline comes about,
which is a bit later on today, and you know,
suddenly everything's all out in the public, are we going
to be happy with that situation because you're not going
to pay the rank, because you're not going to pay
the ransom.
Speaker 3 (01:50):
Well, ultimately that's a question for the company. A government's
policy long standing policy has always been to recommend to
companies not to pay the ransom. That's been the long
standing policy, and there's a range of good reasons for
that policy. But ultimately those are decisions that company makes.
Providing all of the support that we can at this
(02:11):
moment to manage my health. It is a very challenging situation.
As you said earlier, this is New Zealand a's most
personal information and there's a rigorous process going into way
to support this organization or to support a notification process
to those patients.
Speaker 2 (02:27):
So just to reiterate, manage my health is free to
pay the ransom if they decide that's the best course
of action to protect a course the information of one
hundred and twenty thousand New Zealanders.
Speaker 3 (02:37):
Well, look, ultimately that's a question you should put to
manage my health. But as a government, the government's position
has always been we recommend two entities not to pay
rensoms because of a range of reasons. We don't want
New Zealand to become an attractive place for hackers to target,
and we also we want to ensure that in the
(02:59):
reality is these are cyber criminals, and the advice I've
received is that there's no ifdence that by paying that
actually there is actually going to you're going to achieve
the outcome that they say. So the reality is we're
dealing here with cyber criminals, cyber crime as a growing issue.
We're providing as much of support as we can as
(03:21):
a government to this organization, cognizant of the very personal
information that is at hand, and we have also launched
a review because ultimately we need to learn from.
Speaker 2 (03:31):
Us of course, and that's understood. So you say I
should be talking to manage my health I've talked to Veno,
the CEO of Manage my Health once. Then the Herald
tried to talk to him and he didn't. He went strom.
Speaker 1 (03:44):
Then.
Speaker 2 (03:44):
The only time I've seen him actually come out again
was on the television last night. Do you think Manage
my Health have actually been transparent enough in keeping New
Zealanders aware of what's been going on since New Year's
Eve with their personal information.
Speaker 3 (03:59):
Well, my expectation, I've made this very clear to Management
Health is they need to do a bit of job
of communication, both publicly and to those impacted. This is
again incredibly private information. It's a serious breach and they
have a responsibility to communicate, not only under the Privacy Actor,
they have a responsibility to inform those people who had
(04:23):
their data breached, and I'm advised they're going through that
process this week. But ultimately, the as a company have
a responsibility to keep the public informed. My view is
that they should be open, transparent and being proactive in
their communications. They are for putting out daily updates, but
they need to be far more responsive as my opinion.
Speaker 2 (04:43):
Yes, well, my question was based on what they've done
so far. Have they been transparent enough? And you've asked
them to be transparent, but have they already been transparent
enough over the last five days? And I can tell
you we're getting reports out for reports out for reports
that no one has been contacted by the company. There
in the dark. They don't know what's happening, and they're
afraid that all their records are about to become public.
Speaker 3 (05:03):
And I agree with you and I think they should
be doing a better job. They are working very closely.
There is a very closely with Health New Zealand around
the notification process. It does need to be accurate as
well as needs to be done quickly. There is I
had a meeting with the Privacy Commissioner yesterday to talk
through that they are doing the support company in terms
(05:24):
of their notification process. They put out an extent of
update last night which talks through the steps that they're
taking and the approach. I understand based on that update
that they informed GP Practices yesterday with a list of
names of patients who have had their data breached. So
they're working, they're working through that process. My view is
(05:45):
very clear they need to be doing a better job,
a far better job at communicating publicly and also with
those who are those New Zealanders who use their service.
It has not been that. I don't believe they've been
communicating as effectively as they can. It is a challenging
situation for the company, but communication is key to these situations.
Speaker 2 (06:04):
So a question has been asked, why was this app
which is used by a third of the popular controlled
by a private company anyway, and not the government in
the first place. And the question arises because it does
seem to be a disconnect between you, the people who
are funding it, and the people who have purchased the
contract and the company in terms of knowing what's happening
with New Zealander's health records. And the suggestion is that
(06:27):
if the government held it in their own hands, you
could have answered a lot of the questions that you're
not answering now.
Speaker 3 (06:33):
Well. The issue is that health data is held by
a range of organizations. They have obligations under the Privacy Act,
whether that's the government or whether that's a private provider,
whether it's Managed my Health for insurance company, product hospital,
GP practice, aged care, residential service. There's many players who
hold private health data. They required under the Privacy Act
(06:57):
to hold that in a way that is safe they
have obligations to do that and in our expectation of
whether that's a government agency or a private entity, is
that it has held to the highest of standards. That
is why we've launched this review because ultimately we have
seen a significant failure here and we need to learn
(07:18):
the lessons from that, and that's exactly what we're going
to do.
Speaker 2 (07:21):
Syrian Brown, Health Minister, I thank you for your time today.
Speaker 1 (07:24):
For more from News Talks at b listen live on
air or online, and keep our shows with you wherever
you go with our podcasts on iHeartRadio.
You're listening to a podcast from News Talks be follow
this and our wide range of podcasts now on iHeartRadio.
Speaker 2 (00:16):
Today's day the deadline to pay the ransom to the
hackers who have stolen New Zealander's health data from Manage
my Health. Around one hundred and twenty thousand New Zealander's
most private information is being held for ransom for sixty
thousand US dollars. The company has issued a High Court
injunction to prevent our info being released by the hackers.
(00:37):
Whether they respect that is anybody's guess. They're not in
this country, they're not subject to that law. And Health
Minister Simmy and Brown yesterday announced a review into the
Manage to My Health data leak a leak. Brown has
stated it's the government's longtime position to never pay ransoms
so as not to endorse criminal activity in Simon Brown
joins me, Now, good morning to your minister. Good morning,
(00:59):
it's deadline day. Is anyone talking to the hackers at all?
Speaker 3 (01:04):
Look, there's a Hall of Government Incident Manager team that's
been established. It has a range of players involved, including
the National Cybersecurity Center, police, et cetera. Look, they are
very focused on supporting manage my health as much as
we can.
Speaker 2 (01:23):
But are they talking to the hackers though.
Speaker 3 (01:26):
Ultimately those questions should be put to them. In regards
to the work that they're doing. There's a lot of
forensic work underway. I'm not going to get into the detail.
Speaker 2 (01:34):
So if the deadline happened, if the deadline comes about,
which is a bit later on today, and you know,
suddenly everything's all out in the public, are we going
to be happy with that situation because you're not going
to pay the rank, because you're not going to pay
the ransom.
Speaker 3 (01:50):
Well, ultimately that's a question for the company. A government's
policy long standing policy has always been to recommend to
companies not to pay the ransom. That's been the long
standing policy, and there's a range of good reasons for
that policy. But ultimately those are decisions that company makes.
Providing all of the support that we can at this
(02:11):
moment to manage my health. It is a very challenging situation.
As you said earlier, this is New Zealand a's most
personal information and there's a rigorous process going into way
to support this organization or to support a notification process
to those patients.
Speaker 2 (02:27):
So just to reiterate, manage my health is free to
pay the ransom if they decide that's the best course
of action to protect a course the information of one
hundred and twenty thousand New Zealanders.
Speaker 3 (02:37):
Well, look, ultimately that's a question you should put to
manage my health. But as a government, the government's position
has always been we recommend two entities not to pay
rensoms because of a range of reasons. We don't want
New Zealand to become an attractive place for hackers to target,
and we also we want to ensure that in the
(02:59):
reality is these are cyber criminals, and the advice I've
received is that there's no ifdence that by paying that
actually there is actually going to you're going to achieve
the outcome that they say. So the reality is we're
dealing here with cyber criminals, cyber crime as a growing issue.
We're providing as much of support as we can as
(03:21):
a government to this organization, cognizant of the very personal
information that is at hand, and we have also launched
a review because ultimately we need to learn from.
Speaker 2 (03:31):
Us of course, and that's understood. So you say I
should be talking to manage my health I've talked to Veno,
the CEO of Manage my Health once. Then the Herald
tried to talk to him and he didn't. He went strom.
Speaker 1 (03:44):
Then.
Speaker 2 (03:44):
The only time I've seen him actually come out again
was on the television last night. Do you think Manage
my Health have actually been transparent enough in keeping New
Zealanders aware of what's been going on since New Year's
Eve with their personal information.
Speaker 3 (03:59):
Well, my expectation, I've made this very clear to Management
Health is they need to do a bit of job
of communication, both publicly and to those impacted. This is
again incredibly private information. It's a serious breach and they
have a responsibility to communicate, not only under the Privacy Actor,
they have a responsibility to inform those people who had
(04:23):
their data breached, and I'm advised they're going through that
process this week. But ultimately, the as a company have
a responsibility to keep the public informed. My view is
that they should be open, transparent and being proactive in
their communications. They are for putting out daily updates, but
they need to be far more responsive as my opinion.
Speaker 2 (04:43):
Yes, well, my question was based on what they've done
so far. Have they been transparent enough? And you've asked
them to be transparent, but have they already been transparent
enough over the last five days? And I can tell
you we're getting reports out for reports out for reports
that no one has been contacted by the company. There
in the dark. They don't know what's happening, and they're
afraid that all their records are about to become public.
Speaker 3 (05:03):
And I agree with you and I think they should
be doing a better job. They are working very closely.
There is a very closely with Health New Zealand around
the notification process. It does need to be accurate as
well as needs to be done quickly. There is I
had a meeting with the Privacy Commissioner yesterday to talk
through that they are doing the support company in terms
(05:24):
of their notification process. They put out an extent of
update last night which talks through the steps that they're
taking and the approach. I understand based on that update
that they informed GP Practices yesterday with a list of
names of patients who have had their data breached. So
they're working, they're working through that process. My view is
(05:45):
very clear they need to be doing a better job,
a far better job at communicating publicly and also with
those who are those New Zealanders who use their service.
It has not been that. I don't believe they've been
communicating as effectively as they can. It is a challenging
situation for the company, but communication is key to these situations.
Speaker 2 (06:04):
So a question has been asked, why was this app
which is used by a third of the popular controlled
by a private company anyway, and not the government in
the first place. And the question arises because it does
seem to be a disconnect between you, the people who
are funding it, and the people who have purchased the
contract and the company in terms of knowing what's happening
with New Zealander's health records. And the suggestion is that
(06:27):
if the government held it in their own hands, you
could have answered a lot of the questions that you're
not answering now.
Speaker 3 (06:33):
Well. The issue is that health data is held by
a range of organizations. They have obligations under the Privacy Act,
whether that's the government or whether that's a private provider,
whether it's Managed my Health for insurance company, product hospital,
GP practice, aged care, residential service. There's many players who
hold private health data. They required under the Privacy Act
(06:57):
to hold that in a way that is safe they
have obligations to do that and in our expectation of
whether that's a government agency or a private entity, is
that it has held to the highest of standards. That
is why we've launched this review because ultimately we have
seen a significant failure here and we need to learn
(07:18):
the lessons from that, and that's exactly what we're going
to do.
Speaker 2 (07:21):
Syrian Brown, Health Minister, I thank you for your time today.
Speaker 1 (07:24):
For more from News Talks at b listen live on
air or online, and keep our shows with you wherever
you go with our podcasts on iHeartRadio.
Popular Podcasts
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
The Breakfast Club
The World's Most Dangerous Morning Show, The Breakfast Club, With DJ Envy, Jess Hilarious, And Charlamagne Tha God!