breach.co.nz/print/worksheet-3/
How was it breached?
Twelve real breaches from the register. Read each one and circle how you think it was carried out. Answers and explanations are on the last page. Name: ________________________ Score: ____ / 12
~193,000 customers of Pizza Hut Australia
- ARansomware & extortion
- BThird-party / supply-chain
- CUnsecured / exposed data store
- DNone — not officially confirmed
Sydney hotel confirms a ransomware-linked hack and notifies the regulator; the volume and data categories come from the attacker's claims
- AInsider / human error
- BThird-party / supply-chain
- CRansomware & extortion
- DUnsecured / exposed data store
An online wine retailer's breached database held data on ~928,760 people; the Privacy Commissioner later found it failed to protect them, but the breach method wasn't officially detailed.
- APhishing / social engineering
- BStolen / reused credentials
- CUnsecured / exposed data store
- DNone — not officially confirmed
Loan-brokerage platform confirmed personal information was accessed and downloaded; the attacker's claimed figure of ~444,000 borrowers is unverified
- AThird-party / supply-chain
- BNone — not officially confirmed
- CPhishing / social engineering
- DUnsecured / exposed data store
A records-management contractor was breached, spilling personal data belonging to its many government and health clients.
- AStolen / reused credentials
- BExploited vulnerability
- CThird-party / supply-chain
- DUnsecured / exposed data store
Customer data from this bookseller surfaced on the dark web (HIBP indexed ~836,000 email addresses); Dymocks said the source was an external data partner, not its own systems.
- AStolen / reused credentials
- BUnsecured / exposed data store
- CExploited vulnerability
- DThird-party / supply-chain
Several super funds were hit at once by attackers running large lists of leaked username-and-password pairs against member accounts.
- APhishing / social engineering
- BUnsecured / exposed data store
- CThird-party / supply-chain
- DStolen / reused credentials
Breach of a cloud case-management provider exposed sensitive disability and health data of NDIS participants, carers and provider staff
- AStolen / reused credentials
- BThird-party / supply-chain
- CUnsecured / exposed data store
- DExploited vulnerability
Detailed pay data — including tax file and bank details — for at least 38,000 SA public servants was accessed when the government's outside payroll provider was hit by ransomware.
- ARansomware & extortion
- BNone — not officially confirmed
- CThird-party / supply-chain
- DAll of the above
A major law firm was hit by ransomware and some client data was posted on the attacker's leak site. Because it held data for 65 Australian Government entities, they were exposed too — through the firm, not their own systems.
- AAll of the above
- BThird-party / supply-chain
- CNone — not officially confirmed
- DRansomware & extortion
A leak site claimed to hold sign-in and facial-recognition data on more than a million patrons of NSW venues that used a third-party vendor; the claims are unverified.
- AUnsecured / exposed data store
- BStolen / reused credentials
- CThird-party / supply-chain
- DNone — not officially confirmed
Airpoints members' names, tier status and membership numbers were exposed — not through Air NZ's own systems, but through a breach at a Star Alliance partner's systems (reportedly SITA's passenger processing system).
- AThird-party / supply-chain
- BPhishing / social engineering
- CUnsecured / exposed data store
- DStolen / reused credentials
Answer key — worksheet 3
- 1. Pizza Hut Australia — D: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2023-pizza-hut-australia
- 2. The Fullerton Hotel Sydney — C: Ransomware & extortionThe hotel confirmed it was hacked after the Akira ransomware group listed it on its leak site. The amount and type of data rest only on the group's own claims, which the register doesn't treat as fact (T1486).breach.co.nz/breach/au-2025-fullerton-hotel-sydney
- 3. Vinomofo — D: None — not officially confirmedA finding about failure to protect isn't a finding about method — we don't fill that gap ourselves.breach.co.nz/breach/au-2022-vinomofo
- 4. youX — B: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2026-youx
- 5. ZircoDATA — C: Third-party / supply-chainSupply-chain (T1195): ZircoDATA disclosed a ransomware incident on its own systems, and its government, health and education clients later confirmed their data was exposed — breach one shared supplier, expose its clients.breach.co.nz/breach/au-2024-zircodata
- 6. Dymocks — D: Third-party / supply-chainThird-party / supply-chain (T1195): Dymocks said the breach originated at an external data partner and that systems it controls were not compromised.breach.co.nz/breach/au-2023-dymocks
- 7. Australian superannuation funds (coordinated attack) — D: Stolen / reused credentialsCredential-stuffing — stolen / reused credentials (T1078) at scale.breach.co.nz/breach/au-2025-super-funds
- 8. CTARS (NDIS client-management provider) — B: Third-party / supply-chainCTARS is a cloud case-management provider used across the NDIS sector. Its database was breached, exposing participants of the many providers that relied on it — one supplier, many organisations affected (T1195).breach.co.nz/breach/au-2022-ctars-ndis
- 9. South Australian Government (Frontier Software) — D: All of the aboveBoth apply: ransomware & extortion (T1486) at the payroll provider, and third-party / supply-chain (T1195) exposing the government client.breach.co.nz/breach/au-2021-frontier-sa-gov
- 10. HWL Ebsworth — A: All of the aboveBoth apply: ransomware & extortion (T1486) at the firm, and third-party / supply-chain (T1195) for every downstream agency. Real breaches often carry more than one method.breach.co.nz/breach/au-2023-hwl-ebsworth
- 11. Outabox (NSW clubs & pubs) — D: None — not officially confirmedThe data, scale and origin all rest on the leak site's own unverified claims, and the vendor disputes them. With a charge before the courts and no confirmed account, the register doesn't assert a method.breach.co.nz/breach/au-2024-outabox-clubsnsw
- 12. Air New Zealand — Airpoints — A: Third-party / supply-chainThird-party / supply-chain (T1195): the breach was at an alliance partner's systems, reportedly SITA's passenger processing system — Air NZ's own systems weren't the entry point, and customers were told they didn't need to change passwords.breach.co.nz/breach/nz-2021-air-nz-airpoints