The Context
100,000 patients. One cloud portal. A single extortion demand. In December 2025, attackers breached Manage My Health, stealing sensitive personal health records and holding them to ransom. This wasn’t a random hit. The New Zealand government’s own Cyber Security Strategy 2026–2030 names this breach as a defining example of systemic risk. It points directly to inadequate protections on organisations holding personal information. The Strategy warns of a ‘significant increase in the level of cybercrime’. For directors, this is not a technical glitch. This is a governance failure, now on public record.
The Risk
The Court of Public Opinion is already in session. Every patient whose data was stolen will remember the name of the organisation that failed them. The psychosocial damage is immediate: loss of trust, fear of identity theft, and anger directed at the board. But the legal risk is sharper. Under section 137 of the Companies Act 1993, directors owe a duty of reasonable care, diligence, and skill. The Privacy Act 2020’s Information Privacy Principles require adequate safeguards for personal information. The government has now signalled it will ‘raise the standard of data security’ and explore mandatory cyber risk management for critical infrastructure. When the regulator comes knocking, the defence ‘we didn’t know’ will no longer hold. The NCSC Q1 2025 data shows that most malicious activity was reconnaissance for credentials. The Kordia report reveals a 146% rise in phishing designed to bypass MFA. These are known, material, and escalating threats. Directors who fail to ensure their organisations have adequate protections may face personal liability for breach of duty. The silence of inaction will be costly.
The Control
The solution begins with governance, not technology. You must treat cyber risk as a board-level fiduciary duty, not an IT problem. Demand evidence that your organisation’s cloud infrastructure is configured correctly, that identity and access management is robust, and that multi-factor authentication is not a checkbox exercise but a properly implemented defence against token theft. The government is moving towards punitive enforcement. Your duty is to act now, before the next breach makes headlines.
The Challenge
These are the critical questions you should be raising at the board table:
| Can you provide independent assurance that our cloud-based systems holding personal data have been audited for misconfigurations and vulnerabilities in the last six months? | |
| What specific controls do we have in place to prevent phishing attacks that bypass multi-factor authentication, and when were they last tested? | |
| If a breach like Manage My Health occurred tomorrow, what is our crisis communications plan to protect patient trust and manage the reputational fallout within the first 24 hours? |