← BackTip: choose “Save as PDF” as the printer to download.
Your ad hereSponsor the puzzles & worksheets — the header banner on every printed and downloaded copy.
breach@govern.co.nz
🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/print/worksheet-4/
Quiz worksheet 4 of 6

How was it breached?

Twelve real breaches from the register. Read each one and circle how you think it was carried out. Answers and explanations are on the last page. Name: ________________________ Score: ____ / 12

1. ProsuraAU · Insurance · 2026

Rental-car and travel insurer confirmed a cyber incident that it said may have involved customer contact and policy data, and claim data including driver-licence images

  1. AThird-party / supply-chain
  2. BRansomware & extortion
  3. CUnsecured / exposed data store
  4. DNone — not officially confirmed
2. Deakin UniversityAU · Education · 2022

Contact details of 46,980 students were accessed after staff credentials to a third-party SMS provider were compromised; 9,997 people then received scam texts.

  1. AUnsecured / exposed data store
  2. BPhishing / social engineering
  3. CStolen / reused credentials
  4. DThird-party / supply-chain
3. Australian Clinical Labs — Medlab PathologyAU · Healthcare · 2022

First civil penalty imposed under Australia's Privacy Act

  1. ANone — not officially confirmed
  2. BPhishing / social engineering
  3. CThird-party / supply-chain
  4. DUnsecured / exposed data store
4. Early SettlerAU · Retail · 2024

Furniture retailer breach exposed customer contact data across Australia and New Zealand

  1. AStolen / reused credentials
  2. BThird-party / supply-chain
  3. CRansomware & extortion
  4. DNone — not officially confirmed
5. Transport for NSWAU · Government · 2021

Driver-licence and contact data was taken through a widely-used file-transfer product that many organisations worldwide relied on — not from the agency's own systems.

  1. AThird-party / supply-chain
  2. BStolen / reused credentials
  3. CUnsecured / exposed data store
  4. DExploited vulnerability
6. iiNet (TPG Telecom)AU · Telco · 2025

Around 280,000 iiNet email addresses were extracted after an attacker accessed an order-management system using stolen credentials.

  1. AThird-party / supply-chain
  2. BPhishing / social engineering
  3. CUnsecured / exposed data store
  4. DStolen / reused credentials
7. University of SydneyAU · Education · 2025

About 27,500 current and former staff, affiliates, alumni and students were affected via historical test data files held in an online IT code library.

  1. AUnsecured / exposed data store
  2. BStolen / reused credentials
  3. CThird-party / supply-chain
  4. DNone — not officially confirmed
8. Tasmanian Department for Education, Children and Young PeopleAU · Government · 2023

Tasmanian government data, including children's details, was taken in the global Cl0p campaign against the GoAnywhere file-transfer product.

  1. AStolen / reused credentials
  2. BUnsecured / exposed data store
  3. CExploited vulnerability
  4. DThird-party / supply-chain
9. Ambulance TasmaniaAU · Healthcare · 2020

Ambulance dispatch details — including sensitive health information — were reportedly intercepted from the service's paging network and republished online

  1. AExploited vulnerability
  2. BThird-party / supply-chain
  3. CStolen / reused credentials
  4. DUnsecured / exposed data store
10. FinsureAU · Finance · 2024

Marketing contact data of a mortgage aggregator's customers and brokers was accessed on a third-party platform; the platform's identity and the affected count are disputed.

  1. AStolen / reused credentials
  2. BExploited vulnerability
  3. CInsider / human error
  4. DPhishing / social engineering
11. MediaWorksNZ · Other · 2024

~403,000 New Zealanders' data (MediaWorks' figure) taken from a largely competition-entry database; some people then received emailed payment demands

  1. ARansomware & extortion
  2. BInsider / human error
  3. CThird-party / supply-chain
  4. DUnsecured / exposed data store
12. Metricon HomesAU · Other · 2025

Australia's largest home builder confirmed a cyber incident; a ransomware group listed it on a leak site and claims to have stolen data.

  1. ARansomware & extortion
  2. BNone — not officially confirmed
  3. CThird-party / supply-chain
  4. DUnsecured / exposed data store

Answer key — worksheet 4

  1. 1. Prosura — D: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2026-prosura
  2. 2. Deakin University — C: Stolen / reused credentialsThe way in was valid but compromised staff credentials (T1078) to the SMS provider — the attacker signed in rather than breaking in.breach.co.nz/breach/au-2022-deakin
  3. 3. Australian Clinical Labs — Medlab Pathology — A: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2022-australian-clinical-labs
  4. 4. Early Settler — D: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2024-early-settler
  5. 5. Transport for NSW — A: Third-party / supply-chainClassic supply-chain (T1195): one compromised vendor product exposes many customers at once.breach.co.nz/breach/au-2021-transport-for-nsw
  6. 6. iiNet (TPG Telecom) — D: Stolen / reused credentialsStolen credentials (T1078): access with a real login, not an exploit.breach.co.nz/breach/au-2025-iinet
  7. 7. University of Sydney — D: None — not officially confirmedThe university disclosed where the data was held, but not how it was accessed — so the register doesn't assert a method.breach.co.nz/breach/au-2025-university-of-sydney
  8. 8. Tasmanian Department for Education, Children and Young People — D: Third-party / supply-chainA supply-chain breach (T1195): one shared third-party product compromised, many victims exposed at once.breach.co.nz/breach/au-2023-tas-education
  9. 9. Ambulance Tasmania — D: Unsecured / exposed data storeNobody broke in. Dispatch messages sent over the pager network were reportedly intercepted, converted to text and posted online — data left exposed in transit, not a hack of Ambulance Tasmania's systems.breach.co.nz/breach/au-2020-ambulance-tasmania
  10. 10. Finsure — A: Stolen / reused credentialsFinsure said the data, held on a third-party platform it didn't name, was accessed by a cyber security researcher using compromised credentials (T1078). Media named a platform as the source; that platform disputes it was breached.breach.co.nz/breach/au-2024-finsure
  11. 11. MediaWorks — A: Ransomware & extortionMediaWorks said personal data on about 403,000 people was taken, and some individuals were then emailed demands for US$500 in Bitcoin — the extortion half of ransomware & extortion (T1486 family). The attacker's larger claimed figure isn't used.breach.co.nz/breach/nz-2024-mediaworks
  12. 12. Metricon Homes — B: None — not officially confirmedMetricon hasn't confirmed what happened or what was taken; the ransomware group's claims are unverified. An attacker's claim isn't a confirmed method.breach.co.nz/breach/au-2025-metricon
breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.