What happened
In March 2024 MediaWorks New Zealand suffered a cyberattack in which the personal information of approximately 403,000 people — collected largely through online competitions — was taken, according to MediaWorks [1news-mediaworks], [rnz-mediaworks]. MediaWorks said the information included names, dates of birth, gender, postal addresses, email addresses and phone numbers, and in some cases images or videos submitted with entries; it said no passwords, ID documents or financial data were involved [1news-mediaworks]. Some individuals received emails demanding payment of US$500 in Bitcoin [rnz-mediaworks-extortion]. The attacker claimed a much larger number of records; that claim is not used here.
Timeline
- 2024-03-14 — A claim about the data was posted on an online forum [1news-mediaworks].
- 2024-03-15 — MediaWorks became aware of the incident [1news-mediaworks].
- 2024-03-16 — The affected database was taken offline [1news-mediaworks].
- 2024-03 — Affected people received extortion emails [rnz-mediaworks-extortion].
- 2024-03-22 — MediaWorks put the number affected at about 403,000; the Privacy Commissioner and police had been notified [rnz-mediaworks], [1news-mediaworks].
Current status
Disclosed. MediaWorks notified the Office of the Privacy Commissioner and police [rnz-mediaworks]. No Privacy Commissioner investigation or outcome has been published. Figures are as reported.
Why it matters
A widely-felt New Zealand breach, built on data people handed over simply to enter competitions.