What happened
In 2019 Tū Ora Compass Health, a Wellington-region primary health organisation, disclosed that its systems had been breached — with investigation revealing multiple intrusions over prior years — potentially exposing the information of up to around 1 million enrolled patients [cshub-tuora]. A Ministry of Health review and Privacy Commissioner engagement followed.
Timeline
- 2019-08 — Breach detected during a related cyber attack [cshub-tuora].
- 2019-09 — Public disclosure; up to ~1M people potentially affected [cshub-tuora].
Current status
Resolved following review. The “up to 1 million” figure reflects potential exposure as reported; it was not established that all records were accessed. [cshub-tuora]
Why it matters
At the time, the largest health-data exposure in New Zealand — and an early driver of the debate over strengthening NZ’s Privacy Act.