Unauthorised data breach update
Health New Zealand has started the process of notifying individuals impacted by the alleged unauthorised data release by a former staff member.
Pātiki and Waharua Kōpito patterns
Late last year a former Health NZ employee allegedly released sensitive COVID-19 vaccination data, some of which was then posted on overseas websites.
As soon as we became aware, we immediately started an internal investigation to understand the impact of the alleged breach and took urgent steps to have the information removed from websites. We are working closely with the Office of the Privacy Commissioner and liaising with other relevant authorities and cybersecurity experts to assist our inquiry.
An Employment Relations Authority order is in place to prevent further sharing of the data. If we discover that it reappears online, we will continue to pursue all avenues to have it taken down.
Health NZ has started the process of contacting all individuals impacted by this breach to provide guidance, advice and support.
We deeply regret what has happened and apologise sincerely to those affected.
Protecting data and ensuring the privacy of individuals is incredibly important to us. We are working to improve our internal controls and strengthen data security measures to prevent something like this happening again.
Support available for vaccinators
Contact Health New Zealand | Te Whatu Ora
If your information has been affected, Health NZ will contact you directly and provide you with advice and support.
If you are concerned about your information and would like to speak to someone, you can contact us on freephone 0800 321 671 between 8.30am-5pm Monday to Friday, or by emailing securityinfo@tewhatuora.govt.nz
IDCare
If you have been notified by Health NZ that your personal information has been impacted, or you want advice about how to protect your information, you can contact IDCare, a specialist, not-for-profit support provider for people affected by privacy incidents. They provide free, expert advice and support including how to keep safe from identity theft.
- IDCare can be contacted on freephone 0800 121 068 from 10am-7pm Monday to Friday
- Or by visiting iDCare
There is also helpful information about your privacy rights on the Office of the Privacy Commissioner website
Mental Health and Wellbeing Support
- The Mental Health Foundation of New Zealand is a charity that can provide advice and additional help in the form of mental health services. A number of available support services who provide help and guidance can be found on the organisation’s website: mentalhealth.org.nz/helplines.
National Helpline contact information:
- Free call or text 1737 for support anytime from a trained counsellor
- Lifeline – 0800 543 354 (0800 LIFELINE) or free text 4357 (HELP)
- Samaritans – 0800 726 666
- Suicide Crisis Helpline – 0508 828 865 (0508 TAUTOKO)
Frequently Asked Questions
What has happened?
Late last year a former Health NZ employee allegedly released sensitive COVID-19 vaccination data, some of which was then posted on overseas websites.
Who was responsible for this?
This incident resulted from the alleged unauthorised release of information by a former staff member. The Police have charged the person with a criminal offence (accessing a computer system for a dishonest purpose), which is now before the courts.
Is the information still available online?
Once we knew this information was in the public domain, we immediately took steps to have it removed; if it appears on websites, we will continue all efforts to have it taken down.
What has been done?
Health NZ has taken urgent action to protect the privacy of individuals. NZ Police and the Privacy Commissioner have been notified. We have pursued legal avenues to have the data removed in line with Employment Relations Authority orders that prohibit the sharing or public release of data from the unauthorised disclosure. We will do this wherever we become aware of further unauthorised use or disclosure. We continue to work with local and international cyber security experts to assist our investigation and to monitor for signs of any of our data being disclosed online. We are contacting anyone directly affected to offer advice and support.
What is to stop this happening again?
We take data security extremely seriously and deeply regret what has happened. We are looking at our processes to strengthen our data security measures to help prevent an incident like this from happening again.
How can I tell if my information has been affected?
Health NZ will contact impacted people directly. If you have concerns or questions, call us free on 0800 321 671 or email us at securityinfo@tewhatuora.govt.nz
Pātiki and Waharua Kōpito patterns
Staying safe online
Knowing how to recognise and report scams can help keep you and your whānau safe online and protect your personal information. For simple tips and advice, we recommend visiting CERTNZ or Netsafe.