Manage My Health (MMH) Cyber Incident – QMC Patient Update #3

Manage My Health (MMH) Cyber Incident – QMC Patient Update

Published: 9 January 2026 (Update #3)

Termination of Manage My Health contract

Today, QMC has given notice to Manage My Health re termination of contract. Our contract with MMH will end in 90 days, on 9 April 2026.

Since news broke of the30 Dec MMH cyber breach, we have been frustrated and disappointed along with our patients both at the breach itself, and MMH’s response to it.

We began reviewing alternative patient portal providers immediately after the breach was confirmed and have now reached the decision to leave MMH.

We will share more information with patients when we have chosen a new provider.

We’ve answered common questions below and welcome any others you may have.

If you have further questions about this decision, or anything else regarding MMH, please get in touch on 03 441 0500

Can I still use the MMH app?

You can. See below re safety queries.

At the time of writing this update, the MMH website was overloaded and some patients were struggling to use the app.

Once the MMH website stabilizes, patients should be able to book appointments, order scripts and message their GP if they choose to.

We will not switch the data flow back on to MMH for consultation notes and lab results during our90-day notice period.

Is MMH safe to use?

Manage My Health has stated the platform is safe to use after independent verification from cybersecurity experts.

MMH is subject to ongoing forensic monitoring, supported by Health NZ, the Privacy Commissioner, and NZ Police.

We do want to make patients aware that at the time of writing, our understanding is that despite our data flow being switched off for any new consultation notes and new lab results, if your Manage My Health account is open (not closed) your historic data is still stored on the MMH database unless you close your account.

We cannot delete historic data on MMH servers ourselves; only MMH can do this when you close your account.

How do I close my MMH account?

MMH have said that they will communicate with patients via the app regarding their breach status (impacted, or unimpacted). Please be aware of this if you wish to close your account.

The following steps detail how to close your account:

Log into the MMH app or website → go to Profile (outline picture of a person)→ choose Close Account.

QMC can also close your account for you. Please get in touch if you would like us to help you with this.

Practical security tips (quick wins)

·        Change your MMH password and avoid re‑using it on other sites.

·        Enable MFA using an authenticator app. See steps below for how to do this.

·        Be alert to scams and phishing: Don’t click unknown links; report suspicious emails, calls, or messages.

MFA Steps

MFA adds a second check(a code) when you log in, which makes your account much harder to compromise.

1.     Open MMH (app or browser) and sign in.

2.     Go to Profile / Account → Security (or Two‑Factor Authentication).

3.     Choose an Authenticator app (e.g., Google Authenticator or Microsoft Authenticator).

4.     Scan the QR code or enter the setup key shown on MMH.

5.     Enter the 6‑digit code from your app to confirm setup.

6.     From now on, you’ll enter your password and a fresh code from the app each time you log in.

MMH has confirmed support for Google and Microsoft Authenticator apps and encourages enabling 2FA/MFA.

Important reminders and links

Manage My Health will soon release details of an 0800 number for patients affected by the breach. At the time of writing, it was not yet available.

Patients contact: info@managemyhealth.co.nz

FAQs: https://managemyhealth.co.nz/faqs-cyber-breach/

‍

Updates of QMC’s response to MMH’s data breach and any new information we discover with regards to this breach, will continue to be posted on our website and shared through other channels where possible.

‍