What happened
On 30 November 2022 Mercury IT, a Wellington managed-service provider, was hit by a ransomware attack that affected downstream organisations [mercury-1news]. At the Ministry of Justice, about 14,500 coronial files relating to the transport of deceased people (November 2018 – November 2022) and about 4,000 post-mortem reports (March 2020 – November 2022) were affected [mercury-1news]. Te Whatu Ora said about 8,500 Middlemore bereavement records, about 5,500 cardiac and inherited-disease registry records, and records of six health regulatory boards were affected; access was blocked and there was no evidence at the time that they had been downloaded [mercury-1news].
Timeline
- 2022-11 — Ransomware attack on Mercury IT (30 November) [mercury-1news].
- 2022-12 — Downstream impact on the Ministry of Justice and Te Whatu Ora reported [mercury-1news]; interim High Court orders obtained over the data [mercury-opc].
- 2022-12-21 — The Office of the Privacy Commissioner announced a compliance investigation into the breach [mercury-opc].
Current status
Under investigation. The Privacy Commissioner’s compliance investigation commenced in December 2022 [mercury-opc]. No published findings had been located as of November 2026. No total count of affected individuals has been published, so none is asserted here.
Why it matters
A defining New Zealand supply-chain incident — one MSP breach exposing the data of multiple government agencies at once.