breach.co.nz is a public register of reported data breaches across New Zealand and Australia. It exists to turn scattered, hard-to-find breach reporting into a single, sourced, searchable record of what has actually happened — and to do it to a standard that stands up to scrutiny.
We are an index of public record, not an investigator. Every entry is drawn from a regulator, a court, or the affected organisation's own disclosure, and every field links back to its source. We don't make original allegations, we don't take public breach submissions, and we never host or link to breached data itself — only the fact that a breach occurred. Where we don't have an official figure, we label the gap rather than estimate it.
breach.co.nz is published by Govern, our governance and cyber-security brand. Govern helps New Zealand and Australian organisations build security and privacy practices that hold up — the same discipline this register is built on. If the breaches indexed here are the cautionary tales, Govern is the part that helps make sure you're not the next one.
Every record carries a correction and right-of-reply path. If you represent an organisation named here and something is inaccurate or out of date, contact us and we will amend or remove it on verified request: breach@govern.co.nz.
Records are labelled Confirmed (Tier A — sourced from a regulator or court) or Reported (Tier B — credible media or company disclosure, awaiting official confirmation). The Methodology page sets out the full field-by-field sourcing standard, and the Learn section explains the concepts and frameworks behind the cases.