On 30 October 2026 the Privacy Commissioner closed his inquiry into the Manage My Health (MMH) breach. For NZ software vendors, the useful part is not the headline. It is the security standard he published from the compliance notice, which shows how New Zealand's regulator reads the word "reasonable". Most of it can be tested. This guide turns his seven areas into a plan your engineers can use this quarter.
What did the Commissioner actually find?
The attackers logged in with valid stolen patient credentials. They then used that one account to access and copy documents from thousands of other patients' accounts. The Phase 1 report puts the number of affected patients at 99,416, revised down from an early estimate of 126,000. Roughly 90 percent were Northland hospital patients. (Our earlier report on the breach used the higher estimate in our initial Manage My Health breach analysis.)
The findings that matter for testing are specific. Multifactor authentication (MFA) existed but was optional. Web security and access controls were in place but not effective enough. Earlier testing had flagged recurring themes in access control and application security, and those themes had not been adequately addressed when the breach happened. The Commissioner also had concerns about whether some testing and assurance work was effective enough. And MMH's own systems did not spot the intruders. Health NZ told them.
Both MMH and Health NZ were found to have breached rule 5 of the Health Information Privacy Code. Compliance notices followed on 23 September.
Does this apply outside health?
The standard was written for health agencies. The Privacy Act also does not require a penetration test, and our guide to the NZ Privacy Act and pentesting explains that difference. But the final report tells all agencies to review the notices for points that apply to them. Treat the list as the clearest public statement of what "reasonable" means to NZ's regulator when sensitive data is at stake.
What do the seven areas mean as a test plan?
Here is each area, with what a CREST-certified test can show:
1. Multifactor authentication
The standard asks for MFA to be enforced across all user groups and access methods. A tester checks every login path, including the API, password reset and older endpoints, for a way around it.
2. Identity and access management
Access must be checked against the logged-in user's permissions, not just identifiers the user supplies. This is the heart of API penetration testing: log in as one user, change an ID in the request, and see whose data comes back. The standard also asks for a schedule of testing for exactly this.
3. Web security
The standard asks for WAF and firewall protection, controls against automated abuse, and regular testing of both. A test shows whether scripted abuse is slowed, blocked or ignored.
4. Patch and vulnerability management
Fixes must address root causes, and recurring themes must be treated as signs of a wider problem.
5. Secure development
Testing must be comprehensive and risk-aligned, and fixes must be verified before production release.
6. Logging and monitoring
Alerts have to work in practice. A test can record which of its actions your team actually saw.
7. Data leak prevention
Large or abnormal data retrieval should be limited and should raise an alert. With your approval, a tester can try bulk retrieval from one account and see what happens.
If you can only fix two things this month, start with the first two.
They are the route the attackers actually took: a stolen login, then one account reaching other people's records. Enforce MFA for every user, then test every endpoint that returns personal data for cross-account access.
What can a penetration test not do?
A test checks software and configuration. It cannot write your breach plan, set a retention policy or review your contracts. Phase 2 of the inquiry was mostly about those. MMH's 24-month trigger for dormant accounts was too long and breached rule 9. The Commissioner calls 12 months good practice. Hospital data also reached accounts patients had never activated, through a flaw in the matching process that MMH fixed in January. Testing can cover account states such as unactivated, dormant and deceased, but only if you put them in scope.
Test Your Portal Against the Seven Privacy Commissioner Standards
Validate MFA bypass resilience, cross-account access controls, and rate limits with CREST-accredited penetration testing built for NZ software vendors.
How do you close the loop?
The sharpest lesson is that findings existed and themes recurred. A report in a drawer is not protection. The standard asks for fixes to be validated and for repeat themes to trigger wider change. That is what retesting and confirmed closure are for: each finding is fixed, retested and closed with dated evidence. Capture The Bug includes retesting for 90 days.
What will your customers ask next?
The Commissioner said that relying on vendor assurances is problematic. Health NZ cancelled its contract to supply hospital information through MMH and says it is running assurance assessments of patient portals. Expect your customers to ask for independent evidence: a dated CREST-certified report, the retest record, and proof that MFA is enforced everywhere.
Book your free PTaaS demo and ask our CREST-certified testers to scope an authenticated test against these seven areas.
Frequently Asked Questions
What did the Privacy Commissioner find in the Manage My Health breach?
Attackers used valid stolen patient credentials, then one account to copy documents from thousands of others. The Commissioner found MFA was optional, web and access controls were not effective enough, and themes from earlier testing were not adequately addressed. Both MMH and Health NZ breached rule 5 of the Health Information Privacy Code.
Does the Privacy Act require NZ software vendors to run penetration tests?
No. The Privacy Act 2020 requires reasonable security safeguards and does not name penetration testing. A CREST-certified test, with fixes and retests, is strong evidence that safeguards work. The Commissioner's published standard asks for scheduled testing of access control, web security and data leak controls.
What are the seven areas in the Commissioner's security standard?
Multifactor authentication; identity and access management; web security; patch and vulnerability management; system acquisition, development and maintenance; logging and monitoring; and data leak prevention. The Commissioner published them for health agencies and advised all agencies to review the compliance notices for relevant points.
Can a penetration test check MFA and access control?
Yes. A tester can check every login path for ways around MFA, and log in as one user to see whether the system returns another user's data. A test cannot judge policies such as breach plans or account retention periods. Those need a separate review.
Who is responsible when a vendor handles personal data for another organisation?
The Commissioner said a processor that makes a design decision beyond its instructions is treated as acting on its own account and is independently liable. He has also recommended changing the Privacy Act so third-party providers are directly liable for security.
