breach.co.nz/print/worksheet-6/
How was it breached?
Twelve real breaches from the register. Read each one and circle how you think it was carried out. Answers and explanations are on the last page. Name: ________________________ Score: ____ / 12
Film-festival customers' contact details were exposed via unauthorised access to the festival's third-party ticketing system; MIFF counted at least 26,782 customers and disputes an attacker's larger figure.
- AUnsecured / exposed data store
- BThird-party / supply-chain
- CStolen / reused credentials
- DNone — not officially confirmed
Patient files at Australia's largest medical-imaging provider were reportedly accessible via login details shared online; I-MED said it found no significant unusual access.
- APhishing / social engineering
- BStolen / reused credentials
- CUnsecured / exposed data store
- DNone — not officially confirmed
An aged-care provider said an overseas third party accessed its systems and that some data was copied and published; media attributed the attack to a ransomware group.
- AThird-party / supply-chain
- BRansomware & extortion
- CNone — not officially confirmed
- DUnsecured / exposed data store
More than 34 million order records and 5,000+ employee records were left in an unprotected, publicly accessible database. No attacker was required.
- AExploited vulnerability
- BUnsecured / exposed data store
- CStolen / reused credentials
- DThird-party / supply-chain
Second ransomware attack in a year; employee data exfiltrated and later published on the dark web
- AInsider / human error
- BUnsecured / exposed data store
- CRansomware & extortion
- DThird-party / supply-chain
Identity and some health information exposed via the Accellion file-transfer breach
- AThird-party / supply-chain
- BStolen / reused credentials
- CExploited vulnerability
- DUnsecured / exposed data store
GP-clinic patient data exposed through compromised accounts on a third-party booking platform; a large affected count has been reported but not confirmed by the provider
- ARansomware & extortion
- BUnsecured / exposed data store
- CThird-party / supply-chain
- DInsider / human error
A property valuer said around 137,500 valuation records were accessed via what it described as an exposed programming interface on one of its valuation platforms; the data later appeared on a dark-web forum.
- AExploited vulnerability
- BUnsecured / exposed data store
- CThird-party / supply-chain
- DStolen / reused credentials
Personal and health-claims data of around 9.7 million people was taken in a data-theft extortion attack, and some was later published on the dark web. The OAIC's civil-penalty case is before the Federal Court.
- AUnsecured / exposed data store
- BInsider / human error
- CRansomware & extortion
- DThird-party / supply-chain
Vocational-education cyber attack exposing identity documents and financial details of learners, employers, staff and partners; no count has been published
- AUnsecured / exposed data store
- BNone — not officially confirmed
- CPhishing / social engineering
- DThird-party / supply-chain
Nearly 100,000 New Zealanders' health documents were stolen and offered for sale, with a ransom demanded; the Privacy Commissioner later found breaches of Rule 5 and issued compliance notices.
- AThird-party / supply-chain
- BUnsecured / exposed data store
- CInsider / human error
- DRansomware & extortion
A staff member at this disability agency accessed and leaked participants' details; the former staffer was later charged and sentenced.
- AStolen / reused credentials
- BThird-party / supply-chain
- CPhishing / social engineering
- DInsider / human error
Answer key — worksheet 6
- 1. Melbourne International Film Festival — B: Third-party / supply-chainThird-party / supply-chain (T1195): the unauthorised access was to Ferve, the third-party ticketing system MIFF used, not MIFF's own systems.breach.co.nz/breach/au-2026-miff
- 2. I-MED Radiology Network — D: None — not officially confirmedMedia reported credential-based access; I-MED said fewer than 10 accounts were leaked and found no significant unusual access. Reported isn't confirmed — the register labels it rather than picking a cause.breach.co.nz/breach/au-2024-imed
- 3. Regis Healthcare — C: None — not officially confirmedRegis confirmed the access and the publication, but the ransomware attribution comes from media reporting, not an official source — so the method is 'not confirmed.'breach.co.nz/breach/au-2020-regis-healthcare
- 4. Sydney Tools — B: Unsecured / exposed data storeA misconfigured, exposed data store (T1530). When data is public by accident there's no intrusion to detect — the failure is the configuration itself.breach.co.nz/breach/au-2025-sydney-tools
- 5. Toll Group — C: Ransomware & extortionToll was hit by Nefilim ransomware, its second ransomware incident that year. It confirmed data was downloaded from a corporate server, and the data was published on a leak site after Toll refused to pay — classic double extortion (T1486).breach.co.nz/breach/au-2020-toll-group
- 6. NSW Health — A: Third-party / supply-chainNSW Health said its medical-records systems weren't affected. The files were taken through the global Accellion file-transfer breach that also hit Transport for NSW and the Reserve Bank of New Zealand — a supplier's product, not the agency's network (T1195).breach.co.nz/breach/au-2021-nsw-health
- 7. Ochre Health (Tuggeranong) — C: Third-party / supply-chainOchre Health said the access happened through two user accounts on HotDoc, the third-party booking platform the clinic used — exposure through a supplier's system rather than the clinic's own network (T1195).breach.co.nz/breach/au-2026-ochre-health
- 8. LandMark White — B: Unsecured / exposed data storeLandMark White described the cause as an exposed programming interface — data reachable through an interface that should not have been open, rather than a defeated control (T1530). Criminal charges followed; they are allegations and no court outcome is recorded.breach.co.nz/breach/au-2019-landmark-white
- 9. Medibank — C: Ransomware & extortionExtortion (T1486): Medibank disclosed data-theft extortion — the leverage was stolen data. The OAIC's alleged timeline says the attacker logged in to Medibank's VPN; those allegations are not yet determined by the court.breach.co.nz/breach/au-2022-medibank
- 10. Competenz — B: None — not officially confirmedNo official source confirms how this happened, so the register labels the gap rather than guess. 'Not confirmed' is a legitimate — and common — answer.breach.co.nz/breach/nz-2024-te-pukenga-competenz
- 11. Manage My Health — D: Ransomware & extortionRansomware & extortion (T1486): documents were stolen, offered for sale and held to ransom with a threat to publish. The Privacy Commissioner found Manage My Health and Health NZ breached Rule 5 (storage and security).breach.co.nz/breach/nz-2025-manage-my-health
- 12. National Disability Insurance Agency — D: Insider / human errorInsider misuse — no ATT&CK ID by design; the controls here are personnel and privacy, not intrusion detection.breach.co.nz/breach/au-2023-ndia