What happened
In June 2024 Competenz, a New Zealand vocational-education and industry-training organisation, experienced a cyber attack [competenz-notice]. Competenz said the information involved included names, contact details, dates of birth, copies of identity documents (passports, birth certificates, driver licences and citizenship, residence or visa documents) and financial information including card and bank account numbers, belonging to past and present learners, employers, assessors, staff and business partners [competenz-notice]. Competenz said it notified the Privacy Commissioner, the NCSC and NZ Police [competenz-response].
Timeline
- 2024-06 — Cyber attack on Competenz’s IT systems [competenz-notice].
- 2024-08-16 — Competenz publicly confirmed the attack [competenz-scoop].
- 2024-08 — Competenz published a public notice of privacy breach [competenz-notice], [competenz-ib].
Current status
Disclosed. Competenz has not published a count of people affected, so no figure is asserted here. No Privacy Commissioner finding has been found [competenz-notice], [competenz-response].
Why it matters
Vocational-education providers hold enrolment, identity and financial records across large learner and employer populations. The involvement of identity documents and bank details raises the stakes for those affected.