Second NZ health provider, Canopy Health, reveals cyberattack

According to RNZ, Canopy Health, the largest private medical oncology provider in New Zealand, disclosed that on 18 July 2025 an unknown person “temporarily obtained unauthorised access” to a part of its systems used by the administration team. The company said, after a forensic review by its cybersecurity experts, that unauthorised access to one of its servers likely occurred and some data may have been copied, with the incident described as having been “contained” and the investigation ongoing.

DataBreaches[.]Net notes that Canopy Health runs 24 diagnostic clinics, eight oncology clinics, two private breast surgical centres and a drug compounding business. In its FAQ, Canopy states that it obtained an urgent injunction from the High Court to prevent use or publication of any information that may have been accessed and that it notified the NZ Police and the Office of the Privacy Commissioner. The article raises questions about the role of injunctions in relation to media reporting and cybersecurity accountability in New Zealand.