Canopy Healthcare’s Cyber Response  

In 18 July 2025, Canopy Healthcare identified that an unknown person temporarily obtained unauthorised access to a part of our information systems used by our administration team.    
All our services continued to operate as normal. Our clinics, patient services, electronic health record systems, appointments and medical records were not affected.  

The company acted with urgency and took immediate steps to contain the incident and further secure our information systems.  
We confirmed that the incident was contained in a specific administrative folder and did not affect any of our clinics, patient services, electronic health record systems, appointments and medical records.  
In addition to immediately securing our systems, we worked with independent cyber experts to respond to the incident and understand what data may have been affected. We also applied for and obtained an urgent injunction from the High Court to prevent use or publication of any information that may have been accessed and notified the NZ Police and the Office of the Privacy Commissioner. 

Canopy’s cyber team have been working hard to identify the data that may have been impacted in the incident so that we could directly contact individuals potentially affected  
This has been a technically complex and time-consuming process, that has involved the use of specialist tools. Due to the nature of the breach and the internal security controls in place to protect the data, there continues to be some uncertainty as to the exact data that may have been accessed. However, our assessment confirms that most information potentially affected was likely to be of very low or no risk to individuals. 
In instances where some patient or staff information may have been accessed, we are contacting those individuals directly.  

Following the event, Canopy cyber experts immediately commenced monitoring for the unauthorised use or distribution of potentially affected data. 
At this stage, we are not aware of there being any evidence that any of the potentially affected information has been shared or posted online.  
We will continue this monitoring for the foreseeable future.  
The High Court injunction prohibiting use or publication of any potentially accessed data will remain permanently in place. 

Despite rigorous investigation, we have not been able to confirm who was responsible.  
To date, Canopy has not been contacted by the unauthorised party.  
We have referred the matter to the New Zealand Police. 

It is unlikely that your identity is at risk. However, we continue to recommend caution – not only due to this incident but also as cyber incidents more broadly continue to rise.  

The following sites provide useful information on how you can stay cyber safe: 

• National Cyber Security Centre: provides general online safety advice.   
• Office of the Privacy Commissioner: provides general advice on protection of personal information. 

Please take care when receiving emails or texts that seem unusual or ask for sensitive information or password resets. 
If you get a message you weren’t expecting, especially one asking for payment or personal details, it’s best not to reply. Verify the request through a trusted source before responding. 
If something doesn’t look right, you can let the NZ Police know using their Fraud/Scam/Cyber page. 
Canopy requests for information or payment will only be made using a Canopy Healthcare email address such as canopyhealthcare.co.nz, canopycancercare.co.nz, canopyimaging.co.nz, iMIX.co.nz or absolute.co.nz. 

The unauthorised party may have accessed a small number of bank account numbers, which had been provided to Canopy for payment or refund purposes. We are directly notifying potentially affected individuals.  
It is unlikely the threat actor can take significant action with these details, as sensitive bank account information is highly protected.  
However, if you are concerned, please contact your bank. 

No credit cards were affected. 

There is no evidence of any identity documents being affected for patients. 
There have been some instances of staff identity information potentially being affected, and we have notified those staff to provide support.  

New Zealand passports are considered highly secure and are protected by robust identity verification and anti-fraud measures.
There is currently no requirement to replace a New Zealand passport involved in a data breach due to the high security standards in New Zealand.  

However, you can add an alert to your passport record at this website: Declare your New Zealand passport lost, stolen, damaged or involved in a data breach or scam 

If you place an alert, this means that extra security checks will be done if your passport details appear on a passport, citizenship, or RealMe Verified Identity application. You can continue to use your passport for travel up until the expiry date. 

Canopy acted immediately to contain the incident and determine what information may have been affected with assistance from industry experts. 
Due to the nature of the breach and the internal security controls in place to protect the data, this analysis has been complex and has required the use of leading-edge tools. There continues to be some uncertainty as to the precise data and individuals that may have been affected.  
However, out of an abundance of caution, we are writing to individuals who may have been affected, so that they are informed and also can receive further advice or support.  

Canopy retains information to provide ongoing care, meet legal and regulatory requirements, and ensure the safety and quality of our services. 

Cybercrime is evolving rapidly, and Canopy took immediate steps to contain the incident and further secure information systems.   
 
We are also working with others in the healthcare sector to advance cybersecurity standards, share insights from this incident, and strengthen collective resilience across the industry. 

• National Cyber Security Centre: provides general online safety advice.
• Office of the Privacy Commissioner: provides general advice on protection of personal information.  
• NZ Police via their Fraud/Scam/Cyber page