High Court grants permanent injunction over data stolen in Manage My Health cyber incident

Judge’s new order follows interim injunctive relief issued in January

High Court grants permanent injunction over data stolen in Manage My Health cyber incident

After previously issuing an interim injunction, the New Zealand High Court recently acceded to the request of Manage My Health (MMH) for a permanent injunction regarding patient data stolen during a December 2025 cyber incident. 

On 5 January 2026, Justice Andru Isac of the High Court granted an interim injunction in favour of MMH, the applicant in Manage My Health Ltd v Unknown Defendants [2026] NZHC 2119. The interim injunction sought to: 

  • Require everyone to immediately and permanently delete stolen data in their possession or control or any information obtained from such data 
  • Obligate everybody to immediately and permanently delete and take down all publications of or links to the stolen data or information gleaned from it 
  • Permit the lawful use of the stolen data by Te Whatu Ora, New Zealand police, the National Cyber Security Centre, impacted general practitioner (GP) practices, or their patients 
  • Subject to the three previous items, stop everyone from accessing or handling the stolen data through storing, broadcasting, publishing, sharing, disclosing, or using any information taken from such data 
  • Allow anybody affected by these orders to apply to the court for a variation on 48 hours’ notice 
  • Seal the court file and prevent anyone, except parties to the proceeding, from searching the file without the court’s leave 

At that time, Justice Isac refused to grant final relief on a conditional basis, as MMH had initially suggested, or to issue a permanent injunction without notice. 

The judge acknowledged the unlikelihood that anybody impacted by the injunction would apply to modify the orders or to seek a release from them. However, he recognised the possibility that the orders could have consequences that were not immediately obvious. 

MMH’s request for permanent injunction

In an application seeking final orders, MMH pointed to: 

  • the service of interim orders on 16 media companies and individuals on 6 January 2026 
  • national and international media’s wide reporting of the injunction’s terms 
  • Te Whatu Ora Health New Zealand v Unknown Defendants [2023] NZHC 71, where the High Court had granted a permanent injunction against unknown defendants after a two-month period of well-publicised interim orders 

Arguments of MMH’s counsel

MMH’s counsel alleged that the prior case had circumstances comparable to those in the present case: 

  • The pertinent circumstances have stayed the same since the issuance of the interim injunction six months ago 
  • Major media entities, on which orders had been served, did not seek to be heard 
  • The Office of the Privacy Commissioner (OPC) was conducting an inquiry into the matter, which received much publicity both nationally and internationally 
  • No affected individuals have tried to intervene or be heard in the proceedings, despite widespread awareness regarding the facts resulting in the interim orders and the orders themselves 
  • The interests of the patients adversely affected by the original hack remained compelling factors to justify the issuance of injunctive relief 

High Court’s permanent injunction orders

Justice Isac of the High Court of New Zealand granted orders for a permanent injunction. 

In issuing these orders, the judge considered the evidence supporting MMH’s application and the absence of opposition despite public awareness of the interim orders and the risk of harm to innocent parties safeguarded by the injunction. 

Agreeing with counsel’s reasoning, Justice Isac held that MMH successfully established that a serious question for trial existed and that the balance of convenience firmly favoured a permanent injunction. 

Manage My Health cyber incident

On 1 January 2026, MMH notified the OPC about the December 2025 cyber incident involving the access to, the theft of, and the putting up for sale of New Zealanders’ sensitive health information. 

On 5 January 2026, Health Minister Simeon Brown announced that the Ministry of Health would lead a review, commencing by 30 January, regarding MMH’s and Health New Zealand’s (Health NZ) response to MMH’s cybersecurity breach concerning patient information. 

On 21 January 2026, Privacy Commissioner Michael Webster confirmed that he would be launching an inquiry under s 17(1)(i) of the Privacy Act 2020 to look into the breach. On 27 January 2026, he published the terms of reference for his inquiry.

On 27 May 2026, in the results of the first phase of his independent inquiry into the cyber incident, Webster found that MMH and Health NZ breached the Privacy Act. 

Enjoy this story? Read the latest TMT (telecoms, media, technology) news on the main page! 

Related stories

Latest News

Ex-High Court judge Paul Davison KC KSO becomes independent redress officer

Court of Appeal rejects second planned appeal of destruction order for two dogs

High Court grants permanent injunction over data stolen in Manage My Health cyber incident

Auckland barrister Paul Collins named as new judicial conduct commissioner

High Court refuses cannabis maker's without-notice injunction over rival's product guide