New Zealand’s Privacy Commissioner has found both a major private patient portal vendor and the country’s central public health agency in breach of patient privacy laws, following a December 2025 cyber incident that exposed the sensitive records of nearly 100,000 people.