What happened
In October 2024 a malicious external actor accessed and downloaded occupational health and safety records about Health New Zealand staff in the Central region, spanning 2020–2024; Health NZ disclosed it in March 2025 [hnz-rnz], [hnz-notice]. Health NZ said there was no evidence the data had been shared or posted online [hnz-rnz], [hnz-notice]. This is a separate incident from the insider leak of Covid-19 vaccination data also in this register.
Current status
Disclosed. Health NZ notified the Office of the Privacy Commissioner, which is continuing to engage, and the NZ Police Cybercrime Unit is investigating; Health NZ said it expects criminal charges [hnz-rnz], [hnz-notice]. No charges have been found as of November 2026. No count of affected staff was published, so none is asserted here.
Why it matters
Staff occupational-health records include sensitive medical assessments, and their theft by an external actor raises serious privacy concerns for the health workforce.