← BackTip: choose “Save as PDF” as the printer to download.
Your ad hereSponsor the puzzles & worksheets — the header banner on every printed and downloaded copy.
breach@govern.co.nz
🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/print/match-3/
Puzzle · Match the breach 3

Match the breach

Draw a line from each breach to how it was carried out. Some methods are used more than once. Answers are at the bottom of the page — fold it under before you start.

  1. 1
    Transport for NSWAU · 2021 — Driver-licence and contact data was taken through a widely-used file-transfer product that many organisations worldwide relied on — not from the agency's own systems.
  2. 2
    SquirrelNZ · 2024 — Up to 600 peer-to-peer investors' identity details exposed via a third-party ID-verification system
  3. 3
    Woolworths MyDealAU · 2022 — ~2.2 million customers of the Woolworths-owned marketplace were affected after its customer relationship management system was accessed.
  4. 4
    iiNet (TPG Telecom)AU · 2025 — Around 280,000 iiNet email addresses were extracted after an attacker accessed an order-management system using stolen credentials.
  5. 5
    Victorian Department of EducationAU · 2025 — Student data across Victorian government schools was accessed via one school's network; the regulator investigated.
  6. 6
    Telstra (unlisted-number disclosure)AU · 2022 — About 132,000 customers who had paid to keep their numbers unlisted (as reported) had their details published — the result of a database misalignment, not an external attacker.
  7. 7
    Sydney ToolsAU · 2025 — More than 34 million order records and 5,000+ employee records were left in an unprotected, publicly accessible database. No attacker was required.
  8. 8
    Queensland University of TechnologyAU · 2022 — Bank account numbers — and, for 3,820 people, tax file numbers — of 11,405 people, mostly current and former staff, were exposed in an attack QUT attributed to the Royal ransomware variant.
  1. AThird-party / supply-chain
  2. BInsider / human error
  3. CExploited vulnerability
  4. DUnsecured / exposed data store
  5. EStolen / reused credentials
  6. FRansomware & extortion
✂ - - - - - - - - - - - - fold here - - - - - - - - - - - -

Answers: 1–A · 2–A · 3–E · 4–E · 5–C · 6–B · 7–D · 8–F. Full explanations: breach.co.nz/quiz

breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.