MMH, a privately run patient portal used by some general practices, detected the breach in the early hours of 31 December 2025.