An acute cyberattack on a widely used New Zealand medical app forced staff at an aged-care home back to paper records, scrambled patient data and, in a striking flourish, renamed some residents after a polarizing American political figure.
A System in Disarray
When the screens began to empty, the nurse thought it was a glitch. Patients’ names, once neatly arranged in rows on the MediMap platform, started disappearing in real time. Others were suddenly marked as deceased.
“We just kept losing more patients from the screen,” the nurse told Stuff Digital. “And so I started panicking because it was nearly tea time and medications were not going to be given.”
The chaos followed what MediMap, a widely used New Zealand medication management app, later described as “unauthorized activity” that resulted in patients’ demographic records being “incorrectly modified.” The disruption was immediate and destabilizing. At one aged-care home in particular, routine practices unraveled as staff struggled to reconcile digital records that no longer reflected reality.
Medication rounds were delayed. Residents appeared to vanish from the system. For caregivers accustomed to relying on a centralized digital chart, the uncertainty rippled through the facility. By the time staff grasped the scale of the problem, they were confronting not just technical errors, but a profound breakdown of trust in the system meant to safeguard patient care.
FCRF Launches Flagship Certified Fraud Investigator (CFI) Program
Reverting to Paper
In the aftermath of the breach, the facility was forced to revert to paper-based medication charting — a laborious process that many providers had long ago abandoned in favor of digital systems.
The return to handwritten records had what one staff member described as a “knock-on effect,” slowing workflow and compounding anxiety already heightened by the data disruptions. The shift underscored how deeply embedded MediMap had become in daily operations.
MediMap is used by around 60 percent of aged-care facilities in New Zealand, according to the company. More than 2,000 general practitioners, 340 facilities and 350 pharmacies depend on its infrastructure. The hack, therefore, was not confined to a single institution; it had the potential to reach into tens of thousands of patient records nationwide.
The affected data included names, dates of birth, assigned prescribers, locations of care and resident status. In some cases, patients were even reassigned to different facilities within the system. Staff members reported that the platform required both a company login and a personal login, but did not use two-factor authentication.
“Hacktivist” Tactics
Beyond the operational damage, the attack carried an overtly political signature. According to accounts reported by Stuff Digital, some patient names were changed to “Charlie Kirk,” described in the publication as a firebrand conservative figure in the United States. The apparent use of a politically charged name, observers suggested, could be interpreted as a form of hacktivism — an attempt to imprint a political message onto a healthcare infrastructure.
The act of renaming elderly residents within a medical system added a layer of symbolism to the breach, transforming what might have been understood as a conventional data attack into something more theatrical and confrontational. MediMap did not characterize the motive behind the intrusion, confirming only that unauthorized modifications had occurred.
The Human Toll
For frontline staff, the episode was less about symbolism than survival. “We just kept losing more patients from the screen,” the nurse said, describing the moment she realized the enormity of the situation. With medications scheduled and residents waiting, the digital confusion threatened to translate into missed doses and compromised care.
The panic, she said, set in as tea time approached — a seemingly ordinary marker in the rhythm of a care home day, suddenly overshadowed by uncertainty. The incident illustrated the fragility of modern healthcare systems that depend on interconnected digital platforms. When those systems falter, even briefly, the consequences are not abstract.
They unfold in medication carts, in nursing stations, and in the anxious recalculations of staff trying to reconstruct order from corrupted data. As investigators work to determine the scope and source of the intrusion, the episode stands as a reminder of how quickly a breach in cyberspace can cascade into the intimate spaces of patient care.
