Unauthorised data breach and attempt to spread misinformation
Health New Zealand | Te Whatu Ora has taken action in relation to claims on social media connected to a recent data breach by a staff member.
Pātiki and Waharua Kōpito patterns
We believe the threat in the social media post to release private health information accessed from Health New Zealand | Te Whatu Ora breaches current orders from the Employment Relations Authority and as such we have responded accordingly.
The Covid vaccination data set previously posted on overseas websites contained information which included vaccination information and dates, though the contents were altered to anonymise individuals.
Our investigation thus far has shown that with considerable effort, we believe someone with expert technical knowledge could potentially identify a very small number of individuals, some of these individuals are deceased. Once our forensic work is complete, we will contact the families of those that could be identified.
We can also confirm that the investigation has found the employee inappropriately sent some other information outside the organisation. There is no evidence at this time this information was shared publicly, or with other people, however we are working with experts to provide us with further assurance this information was not shared more widely.
Once our work is complete, we will contact those significantly impacted by this breach.
Support available
Contact Health NZ
We are in the early stages of investigating this unauthorised data breach and we are still working through exactly what the information is and who may be affected.
Our investigation into the unauthorised disclosure of data by a staff member remains ongoing.
If your information, or information about a family member, is affected in any way, you will be contacted directly and provided support.
If you are concerned about your health information and would like to speak to someone, you can contact Health NZ on freephone 0800 321 671 from 8.30am-5pm Monday to Friday or email customerservice@health.govt.nz
iDCare
If you have been notified by Health NZ that your personal information has been impacted, or you want advice about data protection, you can contact iDCare, a specialist, not-for-profit support provider for people affected by privacy incidents. They provide dedicated case managers free of charge who can provide expert advice and support, including how to keep safe from identity theft.
- iDCare can be contacted on freephone 0800 121 068 from 10am-7pm Monday to Friday
- Or by visiting iDCare.
There is also helpful information about your privacy rights on the Office of the Privacy Commissioner website
Frequently Asked Questions
What has happened?
What has happened?
At the end of November 2023, we became aware that a staff member inappropriately accessed and used data relating to Covid-19 vaccinations. This data was anonymised and published on overseas websites. We successfully requested the data be taken down from websites and continue to pursue all avenues to remove it if it reappears.
Our investigation has found the employee inappropriately sent some other information outside the organisation. There is no evidence at this time this information was shared publicly, or with other people, however we are working with experts to provide us with further assurance this information was not shared more widely.
What kind of information has been accessed?
What kind of information has been accessed?
The Covid vaccination data previously posted on overseas websites contained information which included vaccination information and dates, though the contents were altered to anonymise individuals.
Our investigation so far has shown that, with considerable effort, we believe someone with expert technical knowledge could potentially identify a very small number of individuals, some of these individuals are deceased. Once our investigation work is complete, we will contact those individuals and whānau members impacted by this breach.
What have we done to fix the situation?
What have we done to fix the situation?
Health New Zealand | Te Whatu Ora took immediate action to protect the information involved. The Privacy Commissioner has been notified and we commenced a comprehensive investigation, which remains ongoing.
The Police have charged the employee with accessing a computer system for a dishonest purpose.
We successfully requested that information relating to the Covid-19 vaccine data be taken down from websites and an injunction is in place to prevent further sharing of it. The staff member involved in this incident is no longer at work and is currently subject to court proceedings.
We have also taken the following steps:
- The employee’s access to our systems and information was immediately disabled.
- We have placed the highest priority on investigative work, including using cross-government skills and international expertise in cyber and data security.
- We obtained urgent orders from the Employment Relations Authority that prohibits sharing of relevant information (both by the staff member and other parties).
What is to stop this happening again?
What is to stop this happening again?
We take data security seriously and are deeply disappointed by this gross breach of trust. Alongside our operational response we are looking at our processes for data security and will make any changes that are needed to further increase the security of information.
How can I find out if my information has been affected?
How can I find out if my information has been affected?
Health NZ will contact impacted people directly. If you have concerns or questions, you can email us at securityinfo@tewhatuora.govt.nz
I’ve been informed my or my whānau data is potentially identifiable, how can I get support?
I’ve been informed my or my whānau data is potentially identifiable, how can I get support?
You may wish to contact iDCare, a specialist support provider for people affected by privacy incidents. iDCare can be contacted on freephone 0800 121 068 from 10am – 7pm Monday to Friday or visit their website.
Vaccination safety
Claims made by the staff member about vaccines is completely wrong and ill-informed – vaccines are safe and effective. There is no evidence whatsoever that vaccination is responsible for excess mortality in New Zealand. You can continue to have confidence in vaccines.