Kazu

Profile narrative

The threat actor known by the alias "Kazu" emerged into public view through a ransomware operation targeting ManageMyHealth, a trans-Tasman health portal serving patients in New Zealand and Australia. On December 30, 2025, Kazu exploited compromised credentials to gain unauthorized access to the platform, bypassing what investigators described as insufficient access controls protecting specialist referral documents. Once inside the network, the actor exfiltrated approximately 108 gigabytes of sensitive medical and personal data, affecting more than 100,000 patients across the region. The stolen information included confidential clinical records and identifying personal details, with the portal's CEO publicly confirming that his own medical records were among those compromised.

Following the data theft, Kazu issued a ransom demand of $60,000 and leaked sample patient records through a Telegram channel to apply pressure on the victim organization. The dual-extortion approach, combining data exfiltration with public shaming and ransom demands, demonstrates a financially motivated operational model consistent with contemporary ransomware affiliate behavior. The incident triggered a High Court injunction aimed at preventing third parties from accessing the leaked data and prompted an official government review of ManageMyHealth's security practices. Notably, affected patients were not directly notified of the breach by the portal operator; instead, many learned of the compromise through public website notices and media coverage only after the platform had been secured. This communication failure drew additional criticism and amplified the reputational damage to the organization.

Public reporting attributes this campaign to "Kazu," though detailed attribution regarding the actor's geographic origin, organizational structure, or potential state affiliation has not been publicly established. The use of Telegram for data leak publicity is a tactic commonly associated with independent ransomware operators and loosely affiliated criminal networks rather than state-sponsored campaigns. The targeting of a regional healthcare portal, combined with a relatively modest ransom demand compared to the scale of data stolen, suggests the actor prioritized monetizing the breach through ransom payment and potential secondary data sales rather than purely destructive or espionage-driven objectives. Beyond this single documented incident, no additional campaigns have been publicly attributed to the Kazu alias within the available reporting, leaving the actor's broader operational history, tooling preferences, and affiliations largely undisclosed.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.