Understand the breaches — not just read about them.
Every record in the register is a real-world case study. This section explains the concepts behind
them, the frameworks that govern them in New Zealand, Australia and abroad, and exactly where our data comes
from — and where it doesn't.
Start here
Key concepts you'll see across the register
🗄️
Data breach
Unauthorised access to, or disclosure of, personal or sensitive information.
Seen in: every record
📤
Exfiltration
The attacker copies data out of the network — the step that turns an intrusion into a breach.
Seen in: Australian Clinical Labs
🔒
Ransomware
Malware that encrypts systems for extortion — increasingly paired with data theft ("double extortion").
Seen in: Langley Twigg
🎣
Phishing & credential theft
Tricking staff into handing over logins — still the most common entry point.
The most common first step
🔗
Supply-chain / third-party
The victim is breached through a vendor or IT provider, not directly.
Seen in: Partnered Health
🕳️
Dark-web leak
Stolen data published or sold on hidden forums when a ransom isn't paid.
Seen in: Langley Twigg
🪪
PII
Personally identifiable information — names, IDs, Medicare/licence numbers, health data.
Seen in: Partnered Health
🔔
Notifiable breach
A breach serious enough that the law requires notifying the regulator and those affected.
The trigger for most records
⚖️
Civil penalty
A court-ordered fine for failing privacy obligations — e.g. Australia's first, A$5.8M.
Seen in: Australian Clinical Labs
Sponsored placement
Reach decision-makers, in-feed
Native placement alongside the breaches your buyers are already reading.
The globally recognised standard for an Information Security Management System.
NIST Cybersecurity Framework
US NIST · CSF 2.0
A widely adopted risk-based framework for structuring a security programme.
GDPR
European Union · General Data Protection Regulation
The benchmark privacy law that shaped notification regimes worldwide.
SOC 2 · PCI DSS
AICPA · PCI Security Standards Council
SOC 2 attests to a provider's controls; PCI DSS governs how card data must be protected.
Where our data comes from
Full transparency — sources we draw from, and ones we don't
✅ Sources we draw from
✓OAICpenalties, determinations, NDB reports
✓NZ Privacy Commissionerbreach notifications, case notes
✓NCSC / CERT NZcyber insights, advisories
✓ACSCframeworks, alerts
✓Federal Court / courtsjudgments & orders
✓Have I Been Pwnednamed breach index
✓Company disclosures & credible mediaclearly labelled when a regulator hasn't yet acted
⛔ Sources we don't
✕The breached data itselfwe index the fact of a breach — never host or link leaked data
✕Threat-actor claims at face valueransomware gangs' "victim" posts are not proof
✕Anonymous forums & social postsunverified, unattributable
✕Public breach submissionswe don't take submissions — it keeps the register accurate & defensible
✕Our own estimatesif there's no official figure, we label the gap rather than guess
🔗 Every record links back to its primary source, and each field follows a fixed source rule. See the Methodology page for the full field-by-field standard.