New Zealand: High Court of Wellington granted interim injunction restraining use and disclosure of health data stolen in cyberattack on Manage My Health portal (No. CIV-2026-485-2 [2026] NZHC 2)

On 5 January 2026, the High Court of Wellington granted an interim injunction in Manage My Health Ltd v Unknown Defendants restraining all persons from accessing or dealing with health data exfiltrated in a cyberattack on the Manage My Health patient portal. The proceedings were initiated by Manage My Health Ltd itself, which applied to the High Court for urgent injunctive relief to prevent further access to, and dissemination of, the stolen patient data. The stolen data comprised approximately 430'000 clinical documents relating to in the order of 127'000 patients and included sensitive personal health information. The Court restrained all persons from accessing, using, storing, publishing, sharing, disclosing, or otherwise dealing with the stolen data. The interim injunction required immediate and permanent deletion of any copies in a person’s possession or control and mandated the removal of any publications of, or links to, the stolen data. The injunction was granted against unknown defendants and any person who has obtained or may obtain the data. The injunction expressly excludes the lawful use of the data by New Zealand’s national public health agency, the New Zealand Police, the National Cyber Security Centre, affected general practices, and their patients. Leave was reserved for any affected person to apply for variation of the orders.