The Context
428,337 files. That is the haul. Over 108 gigabytes of the most intimate details of 127,000 patients—dietary records, mental health notes, scans of medical reports—all silently exfiltrated from the Manage My Health portal by a group calling itself ‘Kazu’. The breach, formally notified to the Office of the Privacy Commissioner on 1 January 2026, was not a sophisticated state-sponsored assault. According to technical analysts, it hinged on ‘specific gaps in code’ in the My Health Documents module. Insecure access controls to object storage meant an attacker could download health documents in bulk without ever compromising a single password. The OPC has opened an investigation, and its public guidance is blunt: ‘Failure to take reasonable steps to protect your personal information against unauthorised access is a breach of the Privacy Act.’ This is not a hypothetical. It is a formal frame for what comes next.
The Risk
The Court of Public Opinion has already delivered its verdict. The psychosocial damage is incalculable: patients who trusted a digital portal with their most sensitive health data now face the reality that their HIV status, cancer diagnoses, or mental health struggles are in the hands of unknown actors. For a health information custodian operating at national scale, this is a brand erosion event of the first order. But the personal liability for directors goes far beyond reputational harm. Under the Privacy Act 2020, a formal OPC finding that MMH failed to take ‘reasonable steps’ creates a direct pipeline to civil proceedings. The Director of Human Rights Proceedings can fund damages claims on behalf of affected patients, seeking compensation for ‘humiliation, loss of dignity, or injury to feelings’. That is a class-action exposure dressed in New Zealand law. Worse still, if it emerges that the board ignored repeated warnings about cybersecurity gaps or under-resourced security, derivative actions under the Companies Act 1993 for breach of directors’ duties become a live threat. The ‘reasonable steps’ test is not a technical benchmark; it is a governance question. Did the board ask the right questions? Did it ensure the company had the resources to protect data? If the answer is no, directors may be personally liable.
The Control
The strategic solution is not a technical patch. It is a governance reset. Boards overseeing health information custodians must treat data security as a board-level risk, not an IT problem. This means commissioning independent audits of access controls, ensuring that ‘reasonable steps’ are documented and tested, and creating a clear chain of accountability from the board to the security team. The OPC investigation will be a watershed; its findings will set the standard for what ‘reasonable’ means in a health context. Do not wait for the determination to become a liability. Act now to close the gap between what your board believes is secure and what a forensic audit reveals.
The Challenge
These are the critical questions you should be raising at the board table:
| What specific evidence do we have that our organisation’s access controls meet the ‘reasonable steps’ standard under the Privacy Act 2020, and when was that evidence last independently verified? | |
| If an OPC determination finds we were non-compliant, what is our plan to manage the resulting class-action exposure and the psychosocial harm to affected patients? | |
| Have we reviewed our directors’ and officers’ insurance to confirm it covers the costs of defending a privacy-related class action or a derivative claim under the Companies Act 1993? |