What happened
In November–December 2022 a ransomware attack on Mercury IT, a Wellington managed-service provider, cascaded to numerous downstream organisations — including the Ministry of Justice (where thousands of coronial files were affected), health agencies and insurers [nzherald-mercury]. The NZ Privacy Commissioner opened an investigation [nzherald-mercury].
Timeline
- 2022-11 — Ransomware attack on Mercury IT [nzherald-mercury].
- 2022-12 — Downstream impact confirmed; Privacy Commissioner investigation announced [nzherald-mercury].
Current status
Reported and under investigation; figures reflect reporting at the time. This record will upgrade to Tier A when official findings are published. [nzherald-mercury]
Why it matters
A defining New Zealand supply-chain incident — one MSP breach exposing the data of multiple government agencies at once.