The medical data of patients across Wellington, Kapiti and Wairarapa may have been breached.

An investigation into the August cyberattack on Primary Health Organisation (PHO) Tū Ora Compass Health, has revealed earlier ones dating back to 2016.

Tū Ora holds data on individuals dating back to 2002 and says anyone enrolled from that time could be affected. Estimates put the number of people that could have been affected at up to one million.

It said hackers could not have accessed private GP notes as they're held by individual medical centres rather than the PHO.

• Auckland Asics store screens hacked to show pornography
• Government allocates $8.7 million to help those impacted by Christchurch terrorist attack

The Ministry of Health says there was some important data in Tu Ora's systems.

"The data does include who is enrolled at which medical centre, their National Health Index Number, name, date of birth, ethnicity and address," the Ministry of Health said in a statement.

"For some people Tū Ora also holds additional clinical information used for health promotion, such as smoking status, for managing chronic conditions like diabetes, or to deliver services."

Tū Ora said there's no evidence patient data was accessed but people should be wary of unusual online requests.

Anyone who is concerned or wants to know more can call Tū Ora's help line on 0800 499 500 or (06) 927 6930.

Tū Ora said it has notified the police.