← BackTip: choose “Save as PDF” as the printer to download.
Your ad hereSponsor the puzzles & worksheets — the header banner on every printed and downloaded copy.
breach@govern.co.nz
🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/print/match-2/
Puzzle · Match the breach 2

Match the breach

Draw a line from each breach to how it was carried out. Some methods are used more than once. Answers are at the bottom of the page — fold it under before you start.

  1. 1
    Service NSWAU · 2020 — Staff received emails that tricked them into typing their work logins into a fake page; those logins then opened email accounts holding ~104,000 customers' data.
  2. 2
    CTARS (NDIS client-management provider)AU · 2022 — Breach of a cloud case-management provider exposed sensitive disability and health data of NDIS participants, carers and provider staff
  3. 3
    SquirrelNZ · 2024 — Up to 600 peer-to-peer investors' identity details exposed via a third-party ID-verification system
  4. 4
    Toll GroupAU · 2020 — Second ransomware attack in a year; employee data exfiltrated and later published on the dark web
  5. 5
    Sydney ToolsAU · 2025 — More than 34 million order records and 5,000+ employee records were left in an unprotected, publicly accessible database. No attacker was required.
  6. 6
    MedibankAU · 2022 — Personal and health-claims data of around 9.7 million people was taken in a data-theft extortion attack, and some was later published on the dark web. The OAIC's civil-penalty case is before the Federal Court.
  7. 7
    Deakin UniversityAU · 2022 — Contact details of 46,980 students were accessed after staff credentials to a third-party SMS provider were compromised; 9,997 people then received scam texts.
  8. 8
    National Disability Insurance AgencyAU · 2023 — A staff member at this disability agency accessed and leaked participants' details; the former staffer was later charged and sentenced.
  1. APhishing / social engineering
  2. BRansomware & extortion
  3. CInsider / human error
  4. DUnsecured / exposed data store
  5. EThird-party / supply-chain
  6. FStolen / reused credentials
✂ - - - - - - - - - - - - fold here - - - - - - - - - - - -

Answers: 1–A · 2–E · 3–E · 4–B · 5–D · 6–B · 7–F · 8–C. Full explanations: breach.co.nz/quiz

breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.