Cybersecurity funding scrutinised following MMH breach

NEWS - eHealthNews.nz editor Rebecca McBeth

Health Minister Simeon Brown defended the government’s funding of health cybersecurity in Parliament today (January 28) as Labour questioned whether Budget 2024 cuts to data and digital services left the health system more vulnerable.

The questions follow a major data breach at private health organisation Manage My Health in December 2025 that compromised the personal information of more than 120,000 New Zealanders.

Labour health spokesperson Ayesha Verrall challenged Brown on whether cuts to Health New Zealand's data and digital funding in Budget 2024 led to the cancellation of cybersecurity projects.

More than $330 million earmarked for data and digital health initiatives at Health NZ was returned as part of budget savings in 2024.

This included $186 million for 'Data and Digital Foundations and Innovation' and $144 million for 'Data and Digital Infrastructure and Capability – Enabling Health System Transformation' through to 2027-28.

Verrall referenced Health New Zealand's annual review statement, saying that "planned future work on the next stage of cybersecurity capability uplift has been cut," and asked whether this related to the defunding of digital initiatives in Budget 2024.

Brown said the government has "continued to invest in strengthening Health New Zealand's cybersecurity capability" with an additional $9 million in Budget 2024 and $10 million in Budget 2025.

"Over the last two years, Health New Zealand has taken a number of important steps including adoption of new data sharing standards, increasing the use of multi factor authentication to access clinical systems and introducing 24/7 monitoring of devices and systems to detect, quarantine and respond to cyber incidents," Brown told Parliament.

Brown said the government takes the security of health data extremely seriously.

“That is why Health New Zealand has responded by running an all of government response, activated incident controllers to support Manage My Health, ensured that independent cyber security experts have been engaged to provide assurances of Manage My Health's response and provided support for the primary care as they respond,” he said.

Public Service Association national secretary Fleur Fitzsimons has also questioned the impact of budget cuts and downsizing of the digital services teams at Health NZ.

"New Zealanders deserve a health system where their private information is protected. That requires proper investment in IT security and the experts who deliver it - not endless cost-cutting that leaves our systems vulnerable," Fitzsimons said.

Manage My Health has 1.8 million registered users in New Zealand and the breach has prompted a number of investigations.

The Ministry of Health will begin a comprehensive review of the incident at the end of January, examining why critical vulnerabilities remained unaddressed before hackers accessed the system.

Privacy Commissioner Michael Webster has also announced an independent inquiry under the Privacy Act to examine compliance and governance arrangements surrounding the breach.

Image: Health Minister Simeon Brown

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page