The Manage My Health hack stands as one of the most serious privacy breaches in New Zealand’s history. Now, a global cybersecurity group says it has identified the individual behind the attack—and demands justice.
Hackers infiltrated the systems of Manage My Health, a private company that stores patient medical records for thousands of New Zealanders. The attacker, who used the alias “Kazu,” demanded US$60,000 in exchange for not leaking the stolen data. They even posted samples of the sensitive information online to prove they had access. In response, the High Court issued an injunction that bars anyone from accessing or sharing the compromised data. Earlier this month, someone removed all public posts linked to the breach from Kazu’s page.
The International Online Crime Coordination Centre (IOC3) has tracked Kazu since the breach occurred. IOC3 fights online harms like child exploitation, fraud, extremism, and cybercrime. The group shared its findings with RNZ but agreed not to reveal the suspect’s identity to avoid jeopardizing ongoing investigations. Authorities have already received the intelligence.
Caden Scott, executive director of IOC3, stressed the need for caution. “We’re still investigating this individual,” he said. “We don’t want to alert them and drive them underground.” Yet Scott made one thing clear: “We definitely want justice. We want this person arrested.”
He explained that the suspect has launched multiple cyberattacks worldwide—not just the Manage My Health hack. “They’ve targeted numerous institutions across the globe,” Scott noted. Health organizations are especially vulnerable because they hold deeply personal data. “Patients often can’t choose whether to pay a ransom,” he said. “This is sensitive information—mental health notes, diagnoses, prescriptions. Leaking it causes real harm.”
Despite the pressure, Scott strongly advises victims not to pay ransoms. “Paying doesn’t guarantee safety,” he warned. “You might pay half a million dollars, and they’ll still sell your data to others for profit.” Instead, he urges affected organizations to contact law enforcement immediately.
New Zealand’s National Cyber Security Centre (NCSC) is also involved. Chief Operating Officer Mike Jagusch confirmed they know about public claims that identify the hacker. The NCSC works closely with police, Health New Zealand, and other agencies to limit damage and stop further misuse of the data.
Jagusch explained that teams use deep technical analysis and cross-agency collaboration to identify cybercriminals—a process called “attribution.” “Publicly naming a suspect is a whole-of-government decision,” he said. “We only do it when it serves the national interest and when we have high confidence in the evidence.”
For now, the focus remains on protecting citizens and holding the perpetrator accountable. The Manage My Health hack has exposed critical gaps in how health data is secured—and how quickly systems respond to digital threats. As investigations continue, both IOC3 and New Zealand authorities agree: those who exploit medical privacy for profit must face consequences.
“This isn’t just about data,” Scott said. “It’s about people’s lives, dignity, and trust in healthcare. That’s why we won’t stop until justice is served.”
READ: Uganda Refugee Crisis: Aid Cuts Threaten Health and Survival
