What happened
User data from Stuff’s Neighbourly community network was reportedly offered for sale on the dark web over Christmas 2025, and on 1 January 2026 Stuff took the network offline [nb-rnz1], [nb-1news]. Neighbourly notified the Office of the Privacy Commissioner [nb-1news]. In a 3 January 2026 email to users, Neighbourly confirmed that names, email addresses, GPS coordinates, some phone numbers, public forum posts and direct member messages were involved, and said login details were not [nb-ib]. Stuff applied to the High Court at Auckland to stop the data spreading [nb-rnz2] and was granted an injunction [nb-rnz3].
Timeline
- 2025-12 — Data reportedly offered for sale over Christmas [nb-rnz1].
- 2026-01-01 — Neighbourly taken offline [nb-rnz1], [nb-1news].
- 2026-01-03 — Neighbourly emailed users confirming the types of data involved [nb-ib].
- 2026-01-05 — Stuff’s High Court injunction application reported [nb-rnz2].
- 2026-01-06 — Injunction granted [nb-rnz3].
Current status
Disclosed. The data-for-sale listing is attacker-sourced; the company’s confirmation and the High Court injunction corroborate a real personal-data breach [nb-ib], [nb-rnz3]. The company said the breach was quickly contained [nb-ib]. No count of affected users has been published, and the attacker’s own claims are not asserted here.
Why it matters
A neighbourhood network’s private messages and location data are highly personal; putting them up for sale exposes members to targeting and scams.