MediMap begins phased restoration after security incident

NEWS - eHealthNews.nz editor Rebecca McBeth

MediMap has started a phased restoration of its digital medication management platform after going offline in New Zealand due to unauthorised activity in its system.

The privately owned platform, used widely across New Zealand for prescribing, pharmacy dispensing, and medication administration in aged residential care, disability services, hospices, and community health settings, was taken offline after detecting the security breach on 22 February.

The breach involved some resident demographic information being changed including residents’ names, dates of birth, assigned prescriber, allergy or intolerance information and discharge or deceased status.

MediMap says restoration began on 2 March 2026 and facilities where current resident information has not been modified will be restored first following internal validation. 

Facilities where resident information may have been impacted will be contacted directly by MediMap to confirm current resident details prior to restoration.

MediMap has secured a court injunction to protect impacted individuals' information, which prohibits any person from accessing, using, copying, sharing or publishing any MediMap data that may have been unlawfully obtained.

“At this stage, we cannot confirm whether any resident data has been accessed beyond viewing, extracted, or exposed externally. The investigation is ongoing,” an FAQ for providers on MediMap’s website says.

The company says it has rebuilt a secure production environment and completed forensic review and validation of its data before beginning the restoration process. 

Independent cyber security specialists have supported the strengthening of authentication controls.

"We acknowledge the patience and professionalism of providers and their staff, who have continued to deliver care for patients and residents with manual processes during this disruption," MediMap says in a system update on 3 March.

"We are confident in the integrity of the restored environment.”

Providers will be required to validate specific demographic information identified during the investigation before accessing the platform and all user passwords will be reset as part of the security measures.

Healthcare providers have had to revert to manual processes while the system has been offline and must clinically review and reconcile any medication changes made during the outage period. 

Electronic prescribing via NZePS will be progressively re-enabled once the core system stabilises.

Following the initial restoration phase, MediMap will enter a stabilisation and hypercare period with expanded support arrangements to transition back to business-as-usual operations. The phased restoration approach has been shared with Health New Zealand to ensure alignment as services are progressively restored.

"Our shared objective is a safe, structured return to digital medication management that balances clinical continuity with strengthened security controls," MediMap says.

Health New Zealand acting chief information technology officer Darren Douglass says the organisation is supporting MediMap's response and has activated its Cyber Incident Management Team to assist.

“People need and deserve confidence that their private and sensitive health information is secure. Protecting patient data is a priority across the health system,” Douglass says.

MediMap has also notified the Office of the Privacy Commissioner and New Zealand Police about the incident. 

"We understand how concerning this situation has been for residents, patients, families and healthcare providers. We sincerely apologise for the disruption and distress caused," the company says in a statement.

You’ve read this article for free, but good journalism takes time and resource to produce. Please consider supporting eHealthNews by becoming a member of HiNZ, for just $17 a month.

Read more Information Governance news

Return to eHealthNews.nz home page