Privacy concerns are ever mounting. And yet it is easy to assume that privacy breaches only happen to some other organisation or business.
But the recent privacy incident involving Manage My Health challenges that assumption. Privacy breaches can happen to anyone. The real issue is not whether a privacy breach will happen to you. It is whether your systems are set up to prevent it.
What happened
Manage My Health is an online portal used by health providers and patients to store and access health information.
A cyberattack compromised the platform in late 2025. The attackers used stolen login credentials to access a single patient account.
The attack should have been contained to the single compromised account. It was not. Instead, weaknesses in access controls meant that one compromised account was used to access and extract information from thousands of other accounts.
In total, just under 100,000 patients were affected. A large portion of the data came from hospital discharge records that had been stored in the system as part of a wider digital project.
The Privacy Commissioner was notified and investigated the breach. The Commissioner identified a host of failures. Multi-factor authentication was not enforced. Monitoring systems did not detect unusual activity. Vulnerabilities had been identified before but not properly resolved. Governance and risk assessment processes were present but did not lead to effective action.
Both the portal provider and the public health agency involved were found to have failed to meet the standard of “reasonable security safeguards”.
The deeper point: privacy is treated as policy, not systems
Most organisations approach privacy in two ways.
- They have a policy. It aligns with the Privacy Act. It sits on the website.
- They have an incident response plan. If something goes wrong, there is a process to follow.
Both matter. Neither would have prevented this breach.
The investigation points to a different issue. The systems themselves were not secure enough. Privacy controls existed, but they did not work effectively. Decisions about access and usability exposed data to risk. Known issues were identified but not properly resolved.
The findings show that privacy controls must work in practice. Multi-factor authentication was optional, monitoring did not detect large-scale access, and data extraction went unchecked. Controls need to be enforced and tested against real scenarios so that a compromised account cannot move beyond its intended scope.
They also show that the risks of others belong to you. There was heavy reliance on the provider’s own assurances about security, with limited independent checking or ongoing verification. Organisations need to test those assurances and maintain oversight throughout the life of the relationship, not just at the outset.
Finally, the report shows that privacy must shape system design. Risk assessment came too late and did not properly inform how data was stored or matched to accounts. Privacy needs to be built into the design of systems so that sensitive information is only ever put into environments where it can be properly controlled.
Talk to us
The Manage My Health incident and Commisioner’s investigation highlights that privacy risk stems from systems, not just policies or breach response plans.
Holland Beckett’s approach reflects that. Our privacy advice is more than policy writing and incident planning. We work with clients to understand how their systems operate, where risk sits within those systems, and what needs to change before issues arise.
If you would like a privacy health check, want to identify where your risks sit, or need to build a clear response plan, get in touch with our team.

