The Weekly
Brief

On 30 October Privacy Commissioner Michael Webster released the second and final report of his inquiry into the Manage My Health breach of December 2025. The first report, in May, dealt with security and found that both Manage My Health and Health NZ had breached the rules on keeping health information safe; compliance notices followed in September. This one looks at the people. Ninety percent of those affected were Northland hospital patients, so the impact fell hardest on Māori patients, whānau and health services in that region. The Commissioner also found that final notifications to individuals were not completed until March, and said some people could have been told sooner if contact details, systems, contracts and breach planning had been better.

He was clear that the lessons are meant for every organisation, not just health providers. Know what personal information you collect, why you need it and how you handle it. Have a process for dormant customer accounts; his office generally expects a check-in after 12 months of inactivity. Understand when a breach is notifiable, including the “serious harm” test, because poor internal processes are not an excuse for notifying late. And have a breach plan that covers who holds contact details for affected people, who talks to media and the regulator, how breaches get reported upwards quickly, and that key people can be contacted at all times, including over holidays.

In Issue 017 we mentioned that police were investigating a breach at Dunedin health research company Zenith Technologies (ZenTech), which provides clinical trial and laboratory services and works with Health NZ. The story has since grown. The Ministry of Justice has confirmed that Coroners Court information was captured in the ransomware attack, which happened around August 2026 and is attributed to a group calling itself ZaWoo. The ministry says it has no contract with ZenTech, that court systems were not targeted directly, and that it is working with Health NZ and police to find out how the information came to be there. The files largely relate to Otago/Southland cases between 2016 and 2022.

The harm is real and ongoing. The ministry says a small number of current coronial cases have been delayed while the incident is investigated, and Stuff spoke to a family who had waited 36 weeks for answers about their mother’s death. On 31 August the group posted what it said was patient data on the dark web, and ZenTech obtained an interim High Court injunction to stop the data being shared. Health NZ says its own systems were not affected. A dedicated line, 0800 638 924 (weekdays 8am–5pm), has been set up for affected families.

In Issue 016 we covered attackers posing as the help desk in Microsoft Teams. On 30 October Microsoft’s own threat intelligence team published two investigations showing where that leads. The attackers messaged and called staff on Teams from outside accounts with organisation-themed names and support-style display names, then talked them into opening Quick Assist, the remote-help tool built into Windows, and reading out the connection code. No malicious attachment was needed: the attacker simply had the keyboard. From there they dropped files into the Downloads folder, ran their own tools and went after the company’s certificate system to get certificates for administrator accounts. In one case, about 90 minutes after the first session was cut off, a second wave targeted 16 more staff. Microsoft has not linked the activity to a specific group.

Separately, Microsoft has told admins that file sharing in external Teams chats will become available by default. Staff will be able to attach files in chats with people outside the organisation, with Teams granting those people access automatically, subject to your OneDrive and SharePoint sharing settings. The change applies unless your organisation has already explicitly switched it off. Microsoft’s latest update asks admins to set their preference by the first week of November, though rollout dates are not final.

Last week hackers stole about NZ$11.2 billion (US$6.3 billion) in cryptocurrency from Binance, one of the world’s largest crypto exchanges, in an attack that unfolded over about 20 minutes. Blockchain analysis firms TRM Labs, Chainalysis and Elliptic believe North Korea is responsible; North Korea routinely denies such claims. Elliptic called it “almost certainly the single largest known theft of any kind.” Binance halted withdrawals and says it is covering every loss from company funds. About US$3 billion of the stolen assets had been traced, and some has been frozen.

The detail that matters for everyone else is how it may have started. Binance says an initial investigation suggested the breach may have begun with a hacked laptop belonging to one of its engineers, which gave the attacker access to one of its systems and let them make unauthorised withdrawals. Binance has since said it found additional points of breach, so the full picture is not yet known.