← BackTip: choose “Save as PDF” as the printer to download.
Your ad hereSponsor the puzzles & worksheets — the header banner on every printed and downloaded copy.
breach@govern.co.nz
🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/print/match-1/
Puzzle · Match the breach 1

Match the breach

Draw a line from each breach to how it was carried out. Some methods are used more than once. Answers are at the bottom of the page — fold it under before you start.

  1. 1
    Waikato DHB (Te Whatu Ora Waikato)NZ · 2021 — New Zealand's most disruptive health-sector attack took hospital systems offline for weeks, and stolen patient and staff data was later released to media and online.
  2. 2
    Queensland University of TechnologyAU · 2022 — Bank account numbers — and, for 3,820 people, tax file numbers — of 11,405 people, mostly current and former staff, were exposed in an attack QUT attributed to the Royal ransomware variant.
  3. 3
    P&N BankAU · 2019 — Customers of this WA bank had contact details and account balances exposed — about 100,000 people, as reported by media — at its outside hosting provider during a CRM upgrade.
  4. 4
    Sydney ToolsAU · 2025 — More than 34 million order records and 5,000+ employee records were left in an unprotected, publicly accessible database. No attacker was required.
  5. 5
    TicketmasterAU · 2024 — Part of the global Snowflake-related campaign; a threat actor claimed data on 560M customers, a figure Ticketmaster did not confirm
  6. 6
    Telstra (unlisted-number disclosure)AU · 2022 — About 132,000 customers who had paid to keep their numbers unlisted (as reported) had their details published — the result of a database misalignment, not an external attacker.
  7. 7
    iiNet (TPG Telecom)AU · 2025 — Around 280,000 iiNet email addresses were extracted after an attacker accessed an order-management system using stolen credentials.
  8. 8
    Deakin UniversityAU · 2022 — Contact details of 46,980 students were accessed after staff credentials to a third-party SMS provider were compromised; 9,997 people then received scam texts.
  1. AThird-party / supply-chain
  2. BStolen / reused credentials
  3. CUnsecured / exposed data store
  4. DRansomware & extortion
  5. EInsider / human error
✂ - - - - - - - - - - - - fold here - - - - - - - - - - - -

Answers: 1–D · 2–D · 3–A · 4–C · 5–A · 6–E · 7–B · 8–B. Full explanations: breach.co.nz/quiz

breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.