← BackTip: choose “Save as PDF” as the printer to download.
Your ad hereSponsor the puzzles & worksheets — the header banner on every printed and downloaded copy.
breach@govern.co.nz
🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/print/worksheet-2/
Quiz worksheet 2 of 6

How was it breached?

Twelve real breaches from the register. Read each one and circle how you think it was carried out. Answers and explanations are on the last page. Name: ________________________ Score: ____ / 12

1. QantasAU · Other · 2025

About 5.7 million customer records were affected when a third-party platform used by one of the airline's contact centres was accessed after a social-engineering phone call.

  1. APhishing / social engineering
  2. BAll of the above
  3. CNone — not officially confirmed
  4. DThird-party / supply-chain
2. TicketmasterAU · Retail · 2024

Part of the global Snowflake-related campaign; a threat actor claimed data on 560M customers, a figure Ticketmaster did not confirm

  1. AUnsecured / exposed data store
  2. BStolen / reused credentials
  3. CExploited vulnerability
  4. DThird-party / supply-chain
3. Health New Zealand (Te Whatu Ora)NZ · Healthcare · 2023

COVID-19 vaccinator and vaccination data was released without authorisation; Health NZ said a former staff member was allegedly involved, and the charge is before the courts.

  1. ANone — not officially confirmed
  2. BInsider / human error
  3. CStolen / reused credentials
  4. DThird-party / supply-chain
4. Service NSWAU · Government · 2020

Staff received emails that tricked them into typing their work logins into a fake page; those logins then opened email accounts holding ~104,000 customers' data.

  1. AUnsecured / exposed data store
  2. BPhishing / social engineering
  3. CStolen / reused credentials
  4. DThird-party / supply-chain
5. Tū Ora Compass HealthNZ · Healthcare · 2019

Health data of up to ~1 million New Zealanders was potentially exposed across four intrusions dating back to 2016; with no audit logs, it was never established whether records were accessed.

  1. AThird-party / supply-chain
  2. BNone — not officially confirmed
  3. CUnsecured / exposed data store
  4. DRansomware & extortion
6. Waikato DHB (Te Whatu Ora Waikato)NZ · Healthcare · 2021

New Zealand's most disruptive health-sector attack took hospital systems offline for weeks, and stolen patient and staff data was later released to media and online.

  1. AUnsecured / exposed data store
  2. BInsider / human error
  3. CThird-party / supply-chain
  4. DRansomware & extortion
7. PageUpAU · Technology · 2018

Breach of a widely-used HR SaaS platform exposed job-applicant data across many large Australian employers

  1. AUnsecured / exposed data store
  2. BStolen / reused credentials
  3. CExploited vulnerability
  4. DThird-party / supply-chain
8. Genea FertilityAU · Healthcare · 2025

Highly sensitive fertility-clinic patient data was published externally; a representative complaint has been lodged with the OAIC

  1. ARansomware & extortion
  2. BThird-party / supply-chain
  3. CUnsecured / exposed data store
  4. DNone — not officially confirmed
9. Latitude FinancialAU · Finance · 2023

One of the largest AU/NZ breaches — around 14 million records by Latitude's own count — and the first joint OAIC–NZ Privacy Commissioner investigation, but no official finding states how it began.

  1. ARansomware & extortion
  2. BThird-party / supply-chain
  3. CStolen / reused credentials
  4. DNone — not officially confirmed
10. Reserve Bank of New Zealand (Accellion FTA)NZ · Government · 2020

Part of the global Accellion FTA supply-chain breach; hit NZ's central bank

  1. AExploited vulnerability
  2. BThird-party / supply-chain
  3. CUnsecured / exposed data store
  4. DStolen / reused credentials
11. Health New Zealand — Te Whatu Ora (staff data)NZ · Healthcare · 2024

External actor downloaded Health NZ staff occupational-health records — a separate incident from the alleged insider release of COVID-19 vaccination data

  1. APhishing / social engineering
  2. BUnsecured / exposed data store
  3. CNone — not officially confirmed
  4. DThird-party / supply-chain
12. Woolworths MyDealAU · Retail · 2022

~2.2 million customers of the Woolworths-owned marketplace were affected after its customer relationship management system was accessed.

  1. AStolen / reused credentials
  2. BUnsecured / exposed data store
  3. CThird-party / supply-chain
  4. DPhishing / social engineering

Answer key — worksheet 2

  1. 1. Qantas — B: All of the aboveBoth apply: the OAIC said the entry point was a vishing call (phishing / social engineering, T1566), and the data sat on a contact centre's third-party platform rather than Qantas's core systems (T1195).breach.co.nz/breach/au-2025-qantas
  2. 2. Ticketmaster — D: Third-party / supply-chainTicketmaster's data sat in a third-party cloud database caught up in the wider Snowflake-related campaign that hit many companies — a supplier platform, not Ticketmaster's own systems (T1195).breach.co.nz/breach/au-2024-ticketmaster
  3. 3. Health New Zealand (Te Whatu Ora) — A: None — not officially confirmedAn alleged insider case is still an allegation: the charge is before the courts and no outcome is recorded, so the register doesn't assert the method as fact.breach.co.nz/breach/nz-2023-health-nz
  4. 4. Service NSW — B: Phishing / social engineeringPhishing (T1566) was the entry method; the stolen credentials were the result, not the cause. Telling the two apart is half of reading a breach.breach.co.nz/breach/au-2020-service-nsw
  5. 5. Tū Ora Compass Health — B: None — not officially confirmedTū Ora found four intrusions after its website was defaced, but no official source confirms how the attackers got in. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/nz-2019-tu-ora
  6. 6. Waikato DHB (Te Whatu Ora Waikato) — D: Ransomware & extortionRansomware & extortion (T1486): operational lock-up plus a leak threat.breach.co.nz/breach/nz-2021-waikato-dhb
  7. 7. PageUp — D: Third-party / supply-chainPageUp is a recruitment and HR platform used by many large employers. The intrusion was into PageUp's systems, so the job applicants of every employer using it were exposed at once — a textbook third-party breach (T1195).breach.co.nz/breach/au-2018-pageup
  8. 8. Genea Fertility — D: None — not officially confirmedCourt orders cited by media say an attacker accessed Genea's Citrix environment and extracted data, and a ransomware group claimed it — but the entry method isn't officially confirmed, so the register doesn't assert one.breach.co.nz/breach/au-2025-genea
  9. 9. Latitude Financial — D: None — not officially confirmedNo official source confirms the method, so we label the gap rather than guess.breach.co.nz/breach/au-2023-latitude
  10. 10. Reserve Bank of New Zealand (Accellion FTA) — B: Third-party / supply-chainThe Reserve Bank's own systems weren't the entry point. A third-party file-transfer application it used, Accellion FTA, was compromised in a global campaign that hit many organisations at once (T1195).breach.co.nz/breach/nz-2021-reserve-bank
  11. 11. Health New Zealand — Te Whatu Ora (staff data) — C: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/nz-2024-health-nz-staff
  12. 12. Woolworths MyDeal — A: Stolen / reused credentialsStolen credentials (T1078): Woolworths said access was gained via a compromised user credential to MyDeal's CRM system.breach.co.nz/breach/au-2022-woolworths-mydeal
breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.