← BackTip: choose “Save as PDF” as the printer to download.
Your ad hereSponsor the puzzles & worksheets — the header banner on every printed and downloaded copy.
breach@govern.co.nz
🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/print/worksheet-5/
Quiz worksheet 5 of 6

How was it breached?

Twelve real breaches from the register. Read each one and circle how you think it was carried out. Answers and explanations are on the last page. Name: ________________________ Score: ____ / 12

1. TissuPathAU · Healthcare · 2023

Patient details on scanned referrals for people undergoing cancer checks were exposed at this pathology provider — through a third-party IT provider it worked with.

  1. AExploited vulnerability
  2. BUnsecured / exposed data store
  3. CStolen / reused credentials
  4. DThird-party / supply-chain
2. Harcourts Melbourne CityAU · Other · 2022

A Harcourts franchisee's rental-property database — tenants', landlords' and tradespeople's data, including renter photo ID — was accessed by an unknown third party; the cause is disputed.

  1. AStolen / reused credentials
  2. BThird-party / supply-chain
  3. CNone — not officially confirmed
  4. DUnsecured / exposed data store
3. Queensland Department of EducationAU · Government · 2026

Queensland students' and staff details were exposed through the department's outside learning platform.

  1. AStolen / reused credentials
  2. BUnsecured / exposed data store
  3. CThird-party / supply-chain
  4. DExploited vulnerability
4. P&N BankAU · Finance · 2019

Customers of this WA bank had contact details and account balances exposed — about 100,000 people, as reported by media — at its outside hosting provider during a CRM upgrade.

  1. AThird-party / supply-chain
  2. BExploited vulnerability
  3. CUnsecured / exposed data store
  4. DStolen / reused credentials
5. Telstra (unlisted-number disclosure)AU · Telco · 2022

About 132,000 customers who had paid to keep their numbers unlisted (as reported) had their details published — the result of a database misalignment, not an external attacker.

  1. AThird-party / supply-chain
  2. BInsider / human error
  3. CStolen / reused credentials
  4. DPhishing / social engineering
6. Australian National UniversityAU · Education · 2018

A sophisticated intruder accessed this university's administrative systems, which held up to 19 years of staff, student and visitor data; the entry method isn't confirmed in the sources we cite.

  1. AStolen / reused credentials
  2. BThird-party / supply-chain
  3. CRansomware & extortion
  4. DNone — not officially confirmed
7. SquirrelNZ · Finance · 2024

Up to 600 peer-to-peer investors' identity details exposed via a third-party ID-verification system

  1. AUnsecured / exposed data store
  2. BStolen / reused credentials
  3. CThird-party / supply-chain
  4. DExploited vulnerability
8. ProctorUAU · Education · 2020

Leaked user records from a US exam-proctoring service included email addresses from several Australian universities.

  1. AUnsecured / exposed data store
  2. BExploited vulnerability
  3. CStolen / reused credentials
  4. DThird-party / supply-chain
9. AA TravellerNZ · Other · 2021

Long-standing customer data on an AA Traveller legacy system was accessed, including expired card numbers for older records

  1. AThird-party / supply-chain
  2. BStolen / reused credentials
  3. CRansomware & extortion
  4. DNone — not officially confirmed
10. Queensland University of TechnologyAU · Education · 2022

Bank account numbers — and, for 3,820 people, tax file numbers — of 11,405 people, mostly current and former staff, were exposed in an attack QUT attributed to the Royal ransomware variant.

  1. ARansomware & extortion
  2. BUnsecured / exposed data store
  3. CInsider / human error
  4. DThird-party / supply-chain
11. Compass Group (Australia)AU · Other · 2024

Catering and support-services firm confirmed unauthorised network activity and that some data was taken; a ransomware group claimed the attack.

  1. ANone — not officially confirmed
  2. BThird-party / supply-chain
  3. CRansomware & extortion
  4. DUnsecured / exposed data store
12. Nissan OceaniaAU · Other · 2023

Around 100,000 people across AU & NZ (Nissan's figure, which it said may fall after de-duplication); government ID documents exposed for a subset

  1. AStolen / reused credentials
  2. BUnsecured / exposed data store
  3. CPhishing / social engineering
  4. DNone — not officially confirmed

Answer key — worksheet 5

  1. 1. TissuPath — D: Third-party / supply-chainThird-party / supply-chain (T1195): TissuPath was breached through a third-party IT provider; it said its billing information and patient-diagnosis database were not compromised.breach.co.nz/breach/au-2023-tissupath
  2. 2. Harcourts Melbourne City — C: None — not officially confirmedHarcourts said the access followed a service provider's representative using a personal device; the provider, Stafflink, disputes this. With the cause contested, the register doesn't assert one.breach.co.nz/breach/au-2022-harcourts
  3. 3. Queensland Department of Education — C: Third-party / supply-chainSupply-chain (T1195): a vendor platform was the entry point.breach.co.nz/breach/au-2026-qld-education
  4. 4. P&N Bank — A: Third-party / supply-chainThird-party / supply-chain (T1195): the breach happened at a third-party hosting provider, not in the bank's core banking system, which it said was isolated from the affected CRM.breach.co.nz/breach/au-2019-pn-bank
  5. 5. Telstra (unlisted-number disclosure) — B: Insider / human errorInsider / human error — an internal database error, not a hack; the ACMA later issued a remedial direction. Note there's no MITRE ATT&CK ID, because ATT&CK models outside attackers, not internal mistakes.breach.co.nz/breach/au-2022-telstra-silentline
  6. 6. Australian National University — D: None — not officially confirmedANU published a detailed incident report, but the sources this register cites don't establish the entry method — so the honest answer is 'not confirmed.'breach.co.nz/breach/au-2019-anu
  7. 7. Squirrel — C: Third-party / supply-chainThe identity numbers were held by a third-party identity-verification system Squirrel used to onboard investors, not by Squirrel's core systems — the supplier was the exposure point (T1195).breach.co.nz/breach/nz-2024-squirrel
  8. 8. ProctorU — D: Third-party / supply-chainThe records came from ProctorU, the online exam-proctoring service, not from the universities' own networks. One vendor breach reached users at several institutions (T1195).breach.co.nz/breach/au-2020-proctoru
  9. 9. AA Traveller — D: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/nz-2021-aa-traveller
  10. 10. Queensland University of Technology — A: Ransomware & extortionRansomware & extortion (T1486): QUT attributed the attack to the Royal ransomware variant. The group's own leak-site claims have not been independently verified.breach.co.nz/breach/au-2022-qut
  11. 11. Compass Group (Australia) — A: None — not officially confirmedCompass confirmed data was taken but hasn't confirmed the Medusa group's involvement or the data types it claims. An attacker's claim isn't a confirmed method, so the answer is 'not confirmed.'breach.co.nz/breach/au-2024-compass-group
  12. 12. Nissan Oceania — D: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/au-2023-nissan-oceania
breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.