breach.co.nz/print/worksheet-1/
How was it breached?
Twelve real breaches from the register. Read each one and circle how you think it was carried out. Answers and explanations are on the last page. Name: ________________________ Score: ____ / 12
~38,000 hardware-retail customers affected; the company said the data may include contact, login and card details
- AUnsecured / exposed data store
- BRansomware & extortion
- CNone — not officially confirmed
- DThird-party / supply-chain
A Napier law firm had malware deployed on its network and data extracted from a file server; a ransomware group claimed the attack. Privacy Commissioner notified, no formal finding
- AThird-party / supply-chain
- BNone — not officially confirmed
- CStolen / reused credentials
- DRansomware & extortion
Around 12.9 million people (company figure) were affected by a cyber attack on this national e-script provider; it later entered administration.
- AThird-party / supply-chain
- BUnsecured / exposed data store
- CRansomware & extortion
- DNone — not officially confirmed
Student data across Victorian government schools was accessed via one school's network; the regulator investigated.
- APhishing / social engineering
- BNone — not officially confirmed
- CExploited vulnerability
- DStolen / reused credentials
User data from the NZ neighbourhood social network offered for sale on the dark web; Stuff obtained a High Court injunction
- ANone — not officially confirmed
- BUnsecured / exposed data store
- CPhishing / social engineering
- DStolen / reused credentials
A cyber-attack halted freight at major Australian ports for three days and employee data was stolen — but the entry method wasn't officially disclosed.
- APhishing / social engineering
- BNone — not officially confirmed
- CThird-party / supply-chain
- DUnsecured / exposed data store
An IT services provider was hit by ransomware — and because it ran systems for the Ministry of Justice and Te Whatu Ora, the damage reached their data too.
- ANone — not officially confirmed
- BAll of the above
- CRansomware & extortion
- DThird-party / supply-chain
A large NZ GP network had patient data posted to the dark web; early reports of up to 450,000 people affected were never confirmed by Pinnacle.
- ANone — not officially confirmed
- BRansomware & extortion
- CThird-party / supply-chain
- DStolen / reused credentials
Recordings of some court hearings — some confidential — may have been accessed in a cyber incident on Victoria's in-court audio-visual network.
- ARansomware & extortion
- BUnsecured / exposed data store
- CThird-party / supply-chain
- DNone — not officially confirmed
An Australian design platform was breached in 2019; the widely reported user count came from the group that claimed the attack, and Canva did not confirm a figure.
- AStolen / reused credentials
- BPhishing / social engineering
- CNone — not officially confirmed
- DUnsecured / exposed data store
A run of cyber incidents at one university from 2023 to 2025, starting with access to a storage platform
- ARansomware & extortion
- BStolen / reused credentials
- CNone — not officially confirmed
- DThird-party / supply-chain
Tier-B case — a malicious actor took patient data from 21 clinics in a national GP network; regulators notified, no official findings yet
- ANone — not officially confirmed
- BUnsecured / exposed data store
- CStolen / reused credentials
- DPhishing / social engineering
Answer key — worksheet 1
- 1. Total Tools — C: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2024-total-tools
- 2. Langley Twigg — Napier law firm — B: None — not officially confirmedThe firm confirmed malware and data extraction, but the ransomware group's role and the data volume rest on its own claims, and the entry method isn't confirmed. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/nz-2026-langley-twigg
- 3. MediSecure — D: None — not officially confirmedMediSecure confirmed the scale and data types, but no official source in the record confirms how the attack happened — so the answer is 'not confirmed.'breach.co.nz/breach/au-2024-medisecure
- 4. Victorian Department of Education — C: Exploited vulnerabilityExploited vulnerability (T1190): according to iTnews' reporting of OVIC's investigation report, the school had not patched a critical vulnerability despite a directive issued after an ASD alert.breach.co.nz/breach/au-2025-vic-education
- 5. Neighbourly — A: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/nz-2025-neighbourly
- 6. DP World Australia — B: None — not officially confirmedDisruption and data theft are the effects; DP World said no ransomware was involved, and with no stated entry method we don't assert one.breach.co.nz/breach/au-2023-dp-world
- 7. Mercury IT — B: All of the aboveRansomware & extortion (T1486) at the provider, plus supply-chain (T1195) reaching every downstream agency.breach.co.nz/breach/nz-2022-mercury-it
- 8. Pinnacle Midlands Health Network — A: None — not officially confirmedMedia named a ransomware group, but Pinnacle hasn't confirmed how the attack happened. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/nz-2022-pinnacle-midlands
- 9. Court Services Victoria — D: None — not officially confirmedMedia named a ransomware group, but Court Services Victoria hasn't confirmed the actor or the method — so the register doesn't assert one.breach.co.nz/breach/au-2023-court-services-victoria
- 10. Canva — C: None — not officially confirmedThe ~139 million figure was the attacker's claim, not Canva's, and no official source confirms how the breach happened. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2019-canva
- 11. Western Sydney University — C: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2023-western-sydney-uni
- 12. Partnered Health — national GP clinic network — A: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2026-partnered-health