Fisher & Paykel Healthcare says there was unauthorised and unlawful access to two employee email accounts and a subset of company files, some containing personally identifiable information; it says patient-data system not shown to be compromised and no ransomware or malware found
Fisher & Paykel Healthcare Corporation Limited, the respiratory care and sleep apnoea device maker listed in New Zealand and Australia (FPH), said in a statement issued from Auckland on 22 October 2026 that it had been made aware of unauthorised and unlawful access to two employee email accounts and a subset of company files, and that it immediately activated its response protocols to contain the incident and investigate.
The company said some of the files accessed contained personally identifiable information, that it is in the process of notifying those affected and that it has notified relevant authorities.
It said there has been no impact to its products, manufacturing operations or supply chain, that there is no evidence the activity compromised the system that maintains patient data, that it has identified no evidence of ransomware or malware, that it believes the incident has been contained, and that it does not expect any material impact on its financials or operations.
The company has not said what kinds of personal information were in the files, how many people are affected or how the accounts were accessed.
Primary: F&P Healthcare statement (22 Oct 2026); exchange filing: NZX announcement; wire: CNA.
- Product
- Fisher & Paykel Healthcare — employee email accounts and company files
- Versions
- n/a — unauthorised access to two employee email accounts and a subset of company files; access method not disclosed
- Exploited in Australia?
- unknown
- Patch to
- People contacted by Fisher & Paykel Healthcare about this incident: follow the company's notification and be wary of unexpected emails that appear to come from F&P staff. Organisations: protect staff mailboxes with phishing-resistant MFA, alert on unusual mailbox access and forwarding rules, and limit sensitive personal information kept in email and shared files.