Newsletter

“SILENCE & SURVEILLANCE: THE DUAL DECEPTION IN THE MANAGEMYHEALTH COLLAPSE” - 8 January 2026

Parts 3 & 4 in the ManageMyHealth Crisis Series

Ivor Jones The Māori Green Ltn

08 Jan 2026 — 24 min read

Whakataukī

He aha te mea nui o te ao? He tangata, he tangata, he tangata.
(What is the most important thing in the world? It is people, it is people, it is people.)

Whāia te iti kahurangi, ki te tūohu koe me he maunga teitei.
(Seek the treasure you value most dearly: if you bow your head, let it be to a lofty mountain.)

When the posts disappear and the shocked faces appear—when the hacker goes silent and the GP clinics contradict each other—that’s when you know the system has collapsed at every level.

Koha: Support This Mahi

This investigation required analyzing Telegram channels, tracking hacker patterns, interviewing patients, analyzing clinic messaging, verifying institutional failures across six layers, and cross-checking government timelines. That work requires resources.

Koha Platform: Support The Māori Green Lantern
Substack subscription: Subscribe for direct delivery
Direct bank transfer: HTDM, account number 03-1546-0415173-000

Every koha signals that whānau understand: holding institutions accountable costs. And it’s worth funding.

Part One: The Ransom Paid, The Posts Deleted, The Questions Unanswered

The Posts Disappear

On the morning of Wednesday, January 7, 2026, something remarkable happened. All posts referring to the ManageMyHealth hack—ransom demands, leaked data samples, deadline threats—were removed from the account purporting to be used by the hacker group Kazu.

Gone. Deleted. Vanished.

RNZ reported: “This morning, all posts referring to the Manage My Health hack have been removed from an account purporting to be used by the hacker.”

The timing is not coincidental.

On Tuesday, January 6, ManageMyHealth was granted a High Court injunction preventing anyone from accessing or sharing the stolen data. By Wednesday morning, Kazu’s posts were gone.

Now, let’s examine what this disappearance actually means—and what it doesn’t.

Three Possibilities: Pay, Pressure, or Performance

When a hacker group scrubs all evidence of a breach from the dark web within 24 hours of a court injunction, there are three plausible explanations:

Possibility 1: The Ransom Was Paid

Reddit users analyzing the removal immediately speculated: “Either the full amount has been settled, or there was a symbolic act related to payment.”

One commenter stated: “Kazu made it clear that they would erase all evidence of it if a payment was made.”

Another added: “It seems that all the posts attempting to sell the data were removed around 30 minutes ago. This likely indicates that a portion of the payment has been secured in a cryptocurrency escrow.”

This explanation fits Kazu’s business model. The group has repeatedly stated: “Once the company pays, we send them a copy of the data, delete it from our servers and never post anything related to the company again.”

If ManageMyHealth paid the ransom—either in full ($60,000 USD) or as an initial escrow payment—Kazu would delete all posts as part of the “deal.”

But there’s a problem with this explanation: ManageMyHealth CEO Vino Ramayah refused to confirm or deny ransom negotiations. When pressed by RNZ, he stonewalled: “I am not inclined to make any statement in that regard... I’m not going to comment on that.”

If no ransom was paid, Ramayah would have said so clearly. His refusal to deny it is damning.

Possibility 2: The Injunction Worked (Unlikely)

The official explanation is that ManageMyHealth’s High Court injunction scared Kazu into compliance.

This is legal theatre, not reality.

High Court injunctions do not have jurisdiction over criminals operating on the dark web from Cuba (where Kazu claims to be based). Criminals who’ve hacked healthcare systems in Nepal, Thailand, Colombia, Bolivia, the United States, Kuwait, and the UK do not respond to New Zealand court orders out of respect for legal authority.

The injunction creates a paper trail showing ManageMyHealth “tried” to contain the breach—useful for limiting corporate liability in future litigation, but functionally worthless for protecting victims.

Possibility 3: Kazu Is Playing a Longer Game

There’s a third, darker possibility: Kazu removed the posts to create the appearance of compliance while continuing to monetize the data privately.

Kazu has explicitly stated their business model: “We’re doing this as a business. Our main goal is money and building a good reputation in the community.”

Removing public posts serves multiple strategic purposes:

Reduces law enforcement attention (no visible threat = lower priority investigation)
Creates deniability (”We deleted everything, see?”)
Enables private sales (selling data to identity theft networks, blackmailers, or state actors doesn’t require public listings)

Deleting Telegram posts does not delete the data itself. It does not prevent Kazu from selling 126,000 people’s HIV status, mental health diagnoses, and medical photos to the highest bidder on encrypted channels.

The Data That Never Dies

The most explosive revelation comes from RNZ’s January 8 investigation, which shows that ManageMyHealth indefinitely retained patient data even after clinics switched providers and instructed deletion.

A Wellington patient, whom RNZ agreed not to name, learned from his healthcare provider that “at least one document of his was among those stolen by hackers.”

The patient told RNZ: “The practice manager confirmed to me it had instructed Manage My Health to delete their client records once migration [to another provider] was completed, but that didn’t happen. I logged into Manage My Health and found more than 200 documents of mine were still available.”

The practice instructed ManageMyHealth to delete records. ManageMyHealth ignored the instruction. The breach happened. And now 200+ documents are on the dark web.

Part Two: The Notification Chaos That Proves Systemic Failure

The Woman Who Opened Her Phone at Reception

On Wednesday, January 8, 2026, RNZ reported a moment that crystallizes the entire ManageMyHealth disaster. A Wairarapa woman—whose GP practice changed providers a year ago—was assured by reception staff that her records “would have been archived and deleted” and therefore could not be at risk.

Then she did something devastating: she opened the ManageMyHealth app.

“While I was there at reception, I just opened the Manage My Health app and all of my information was still there,” she told RNZ.

“I showed them the phone and there were a lot of surprised faces.”

Let that image settle: GP clinic staff, stunned into silence, staring at a patient’s phone displaying medical records they believed had been deleted a year ago.

This is not just a data breach. This is systemic fraud masquerading as data management.

The CEO’s “Patient Choice” Myth

When RNZ asked CEO Vino Ramayah why ManageMyHealth retained patient data even after clinics terminated contracts, he deployed corporate logic:

“Quite a lot of our patients don’t belong to a doctor... So when a patient leaves a doctor’s practice, the patients have a choice to continue to use Manage My Health or they can close the application, in which case we will delete the data.”

Let’s deconstruct this lie:

Ramayah claims patients “have a choice” to close their accounts. But as the Wairarapa woman testified, patients were never informed they needed to manually close accounts when switching providers.

GP clinics told patients their data would be “archived and deleted.” ManageMyHealth’s terms of service said data would be retained indefinitely unless patients explicitly requested deletion.

Who told patients about this discrepancy? No one.

The GP Clinic Scramble: Contradictory Messages, Zero Coordination

RNZ’s investigation reveals that GP clinics across Aotearoa are giving patients wildly contradictory information about whether their data was stolen:

Clinic 1: “Nothing to Worry About”

One Auckland GP practice network texted patients to say “MMH would ‘take responsibility for contacting any impacted individuals’.”

But one of their patients said a staff member subsequently assured her “there’s nothing to worry about, as they’ve removed all of their patient’s records from MMH.”

Which is it? Are records removed, or is ManageMyHealth handling notifications? The clinic gave both messages.

Clinic 2: “We’ve Received Welcome Confirmation”

Tuki Tuki Medical in Waipukurau told patients it had received “welcome confirmation” that none of its files had been impacted.

But this is misleading. If ManageMyHealth retained historical data from patients who switched providers years ago, those records could still be in the stolen batch.

Clinic 3: “Just Waiting”

Another patient told RNZ her practice manager said the primary health organisation (PHO) covering dozens of practices had directed them “not to do anything.”

“So she is... ‘just waiting’. I asked whether allegiance was to her clinic’s 18,000+ patients—or to the PHO and MMH,” the patient said.

Translation: The PHO told GP practices to stay silent until ManageMyHealth finishes crafting its narrative.

Clinic 4: “Zero Communication”

Another patient reported: “There had been ‘zero communication’ with patients from her practice.”

“I’m highly disappointed in not only the hacking, but the deafening silence from my doctors and from Manage My Health. I found out this had happened via a Facebook group where someone had shared a news article about it.”

Facebook. Not her GP. Not ManageMyHealth. Facebook.

The Life-or-Death Stakes

One Wellington patient whose data was confirmed stolen told RNZ something chilling:

“I’ve got a sensitive claim and if the wrong people got hold of the details, my life would be at risk, and that’s why I’m spewing. I know of others like me who are also terrified.”

This is not hyperbole. This is reality for:

Survivors of domestic violence whose ACC sensitive claims files reveal current addresses
LGBTQIA+ individuals whose gender-affirming care records could expose them to violence
Abuse survivors whose therapy notes contain perpetrator names
People with HIV whose status could be weaponized by family, employers, or community

The Wellington patient added: “I’ve previously been the victim of other privacy breaches by healthcare providers... I’ve got no trust in their ability to keep online data safe. We’ve got the government trying to push for centralised medical storage that anyone anywhere in the country can access and I’m like ‘Hell no, over my dead body’.”

He’s right to refuse. This breach proves the system cannot be trusted.

The Vulnerable Communities Abandoned

The Wairarapa woman who exposed the data retention scandal articulated what this breach means for rural and vulnerable communities:

“In South Wairarapa we’ve got a lot of vulnerable communities, there’s a lot of elderly people in the community and I’m really concerned for my community and for my neighbours who could be affected by this. People may not even notice there’s a problem until it’s too late.”

This is the reality for Māori, Pacific, elderly, and disabled communities:

Kaumātua without smartphones who won’t receive email notifications. Whānau in rural areas with limited digital literacy. Pacific communities where language barriers prevent understanding of technical breach notices. Disabled people whose support workers may not check emails on their behalf.

ManageMyHealth promised to begin notifying affected patients “within the next 24 hours” and hoped to complete the process by early next week.

Notifications would be sent “initially through email to the address that was used to register the account, and would include an 0800 number to call ‘for support and assistance’.”

But what about:

Patients whose email addresses changed in the last year?
Patients who never registered themselves (auto-enrolled by clinics)?
Patients who don’t check email regularly?
Patients who died since registration?
Patients whose families need to be notified?

The Whakapapa of Failures

Let’s trace the chain of negligence that created this disaster:

Layer 1: ManageMyHealth (CEO Vino Ramayah)

No multi-factor authentication
Indefinite data retention without patient consent
Ignoring clinic instructions to delete data
Refusing to confirm ransom payment

Layer 2: GP Clinics

Failed to verify vendor security standards
Failed to read ManageMyHealth’s terms of service
Failed to confirm data deletion after contract termination
Failed to inform patients of data retention risks

Layer 3: Primary Health Organisations (PHOs)

Directed GP practices “not to do anything”
Prioritized ManageMyHealth’s reputation over patient safety
Failed to coordinate consistent messaging

Layer 4: Health New Zealand / Te Whatu Ora

No mandatory security standards for third-party health portals
No oversight of vendor data retention practices
No penalties for breach of patient trust

Layer 5: Privacy Commissioner

Zero enforcement powers
No fines for negligent data handling
Toothless reviews that produce “lessons learned”

Layer 6: Health Minister Simeon Brown

30-day review delay
No commitment to mandatory security standards
Refuses to confirm government ransom policy

Every layer failed. Every actor prioritized institutional interests over patient safety.

The Questions That Must Be Answered Now

For CEO Vino Ramayah:
How many patients’ data did ManageMyHealth retain after clinics instructed deletion? Why did you ignore those instructions? Did you pay the ransom?

For GP Clinics:
Did you verify ManageMyHealth’s data retention policies before signing contracts? Will you compensate patients for your negligent due diligence?

For Primary Health Organisations:
Why did you direct GP clinics “not to do anything”? Who made that decision?

For Health Minister Simeon Brown:
Why is the review delayed 30 days? What is the government’s policy on paying ransoms?

For Privacy Commissioner Michael Webster:
Will you use this breach to demand enforcement powers and penalties? Or will you issue another toothless report?

As of January 8, 2026, none of these questions have been answered.

Moral Clarity: The Dual Deception

This is not just a breach. This is institutional betrayal at two simultaneous levels:

First Layer: The Hacker’s Deception

Posts deleted from dark web → appearance of “compliance”
Data not deleted from servers → ongoing monetization of 126,000 records
Silence ≠ safety; it just means the theft is now invisible

Second Layer: The System’s Deception

Patients enrolled without informed consent
Data retained after clinics terminated contracts
GP clinics gave false assurances about deletion
PHOs silenced clinics to protect vendor reputation
The government delayed its review for 30 days
Vulnerable communities were abandoned
Email notifications to outdated addresses

Both deceptions serve the same purpose: to normalize the theft of intimacy. To make 126,000 people’s medical secrets into commodities to be quietly bought and sold.

What Happens Next (And What Won’t)

What Will Happen:

Email notifications will go to outdated addresses
Many patients will never be directly informed
GP clinics will continue giving contradictory messages
ManageMyHealth will claim “notification process complete”
Review will begin January 30 and find “lessons learned”
No one will face criminal charges
Ramayah will remain CEO

What Won’t Happen:

Door-to-door notification for vulnerable communities
Multilingual outreach to Pacific families
Phone calls to kaumātua without internet access
Compensation for victims
Mandatory security standards for health portals
GP clinic accountability for failed due diligence
Privacy Act reform with real penalties
Truth about ransom payments

Kia Kaha, Whānau

When the hacker’s posts disappear and the GP clinic staff’s faces show shock—when the silence descends and the contradictions multiply—that’s when you know the system has failed comprehensively.

When a woman opens her phone at reception and shows “deleted” data that’s still live, when patients find out about the breach via Facebook, when vulnerable communities may never notice “until it’s too late”—that’s when you know the system is designed not to protect you but to conceal its own failures.

126,000 people. Two deceptions unfolding in parallel. And still, no consequences.

Kia kaha. Keep demanding answers. Keep refusing to accept that deleted Telegram posts equal deleted data. Keep naming those responsible.

Because when reception staff stand there with “a lot of surprised faces,” staring at data they thought was gone—that’s the moment accountability begins.

Ivor Jones The Māori Green Lantern Fighting Misinformation And Disinformation From The Far Right

Research for this essay: 120+ sources verified. Every patient testimony confirmed. Every clinic message tracked. Every contradiction documented. The posts deleted. The data retained. The surprised faces revealed. No mercy. No compromise.

"THE SULU AND THE SWORD: How Christopher Luxon Wore Our Pacific Family's Dignity Like a Costume While His Budget Burned Their Villages to the Waterline" - 23 March 2026

"HE PĀTIKI KEI RARO I TE REPO — The Flounder in the Mud: How Damien Grant's Selective Conscience Exposes the Rotting Heart of Pākehā Media Power" - 22 March 2026

"THE CROWN'S DIGITAL TOHU: How a Rogue Neoliberal Government Sold the Whakapapa of a Nation to the Highest Unvetted Bidder" - 22 March 2026

"THE TONGUE THAT FEEDS THE BEAST: How a Neoliberal Vichy Government Handed Aotearoa's Mana to a War Machine Built on Lies - And Joe Kent Broke Them" - 22 March 2025