breach.co.nz is an index of public record, not an investigator. This page sets out what we include, how each field is sourced, and how organisations can correct a record.
This page carries no advertisingAt least one source is a court, or a statutory regulator's own publication about the incident — the OAIC, the NZ Privacy Commissioner, NCSC or ASD's ACSC, a state privacy regulator such as OVIC or IPC NSW, or a sector regulator such as the ACMA. Simply notifying a regulator doesn't count. Tier A records are published as fact. The build will not deploy a Tier A record without one.
Labelled "Reported — awaiting official confirmation", with conservative fields. A Tier B record only goes live once the organisation has publicly admitted the breach and it is in the hands of an authority (regulator, Police or court), with at least one credible independent source. It upgrades to Tier A when a regulator or court acts.
Timeframe: Australia from 2018, when the Notifiable Data Breaches scheme began. New Zealand from December 2020, when mandatory notification under the Privacy Act 2020 took effect. Earlier cases only where notable.
Scope: data breaches affecting people in New Zealand or Australia. A headline using the word "breach" isn't always a data breach — physical-security and service-availability incidents are out of scope.
Threshold: anything with regulator or court action, plus significant breaches that meet the Tier B publication bar above. Threat-actor claims and leak-site posts stay in drafts until they clear it.
| Field | Source rule | If there's no official source |
|---|---|---|
| People affected | The regulator's figure (Tier A) or the organisation's own stated figure, graded Confirmed / Company-confirmed / Media-reported and qualified as exact, approx or minimum. | "Not disclosed". Threat-actor and analyst counts are never used. |
| Data exposed | Categories named by the regulator, the organisation or credible media — each item graded for confidence and tied to a source. | Left out rather than inferred. |
| Penalty | OAIC or court penalty orders, NZ Privacy Commissioner compliance notices, with the source cited. | Shown as no penalty — NZ has no civil-penalty regime for privacy breaches. |
| Status | Disclosed · Investigating · Proceedings filed · Penalty issued · Regulator action taken (e.g. a compliance notice or direction, not a fine) · Resolved · No action · Defunct. | "Disclosed". |
| Regulator | The regulator or authority actually handling the matter, as stated in the sources. | "None reported". |
| Dates | Breach, disclosure and last-verified dates as stated in sources. | Shown as month or year only. |
Every change is a version-controlled commit, so each record has a full audit trail. Records are re-verified when new outcomes land, and each shows its last-verified date.
If you believe a record is inaccurate or out of date, contact us with the record ID and your evidence. We investigate the claim against the underlying sources and then either correct the record or tell you why we've left it as it stands. We don't amend or remove records on request alone.
Inclusion reflects public sources at the time of publication. It isn't a finding of wrongdoing by breach.co.nz, and matters before a regulator or court are described as such.