Your ad hereSponsor the Finance briefing — the header banner on every printed and downloaded copy.
breach@govern.co.nz🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/sector/finance/print/
breach.co.nz/sector/finance/print/
💳 Finance: reported data breaches
Every finance breach in the breach.co.nz register, New Zealand and Australia, 2019–2026. Each line is a public record; follow the short link to see the sources.
9records
101K+people affected (disclosed, 2 of 9)
2 · 7NZ · AU
1confirmed by regulator / court
1penalties or court action
Largest by people affected
- P&N Bank — 100,000 (approx) · AU · 2019-12
- Squirrel — 600 (approx) · NZ · 2024-07
Suppliers named in these records: Metabase (1) · ActivePipe (1). A supplier appearing here is not a finding against that supplier — see each record.
All 9 records
| Organisation | Breach | People | Data reported | Status | Tier |
|---|---|---|---|---|---|
| 🇳🇿 Thankyou Payroll — Metabase-linked incidentbreach.co.nz/breach/thankyou-payroll-metabase | 2026-08 | Not disclosed | IRD; Home addresses | Disclosed | B · Reported |
| 🇦🇺 youXbreach.co.nz/breach/au-2026-youx | 2026-02 | Not disclosed | youX confirmed only that personal information was accessed and downloaded. The attacker claimed the data includes home addresses, income and debt details, government IDs | No further action | B · Reported |
| 🇦🇺 Australian superannuation funds (coordinated attack)breach.co.nz/breach/au-2025-super-funds | 2025-03 | Not disclosed | Member account access via credential stuffing. Per-fund figures as reported: Rest said about 8,000 members may have had personal information accessed; Funds withdrawn: SBS News reported it understands four AustralianSuper members lost a combined ~A$500,000 | Disclosed | B · Reported |
| 🇦🇺 Finsurebreach.co.nz/breach/au-2024-finsure | 2024-10 | Not disclosed | Names, email addresses, phone numbers and physical addresses | Disclosed | B · Reported |
| 🇳🇿 Squirrelbreach.co.nz/breach/nz-2024-squirrel | 2024-07 | 600 (approx) | Name, date of birth, and passport or driver-licence ID numbers | Disclosed | B · Reported |
| 🇦🇺 Firstmacbreach.co.nz/breach/au-2024-firstmac | 2024-04 | Not disclosed | Name, date of birth, address, email and phone number; External bank account details | Disclosed | B · Reported |
| 🇦🇺 Latitude Financialbreach.co.nz/breach/au-2023-latitude | 2023-03 | Not disclosed | Driver licence numbers; Passport numbers | Under investigation | A · Confirmed |
| 🇦🇺 P&N Bankbreach.co.nz/breach/au-2019-pn-bank | 2019-12 | 100,000 (approx) | Names, addresses, email addresses, age, customer and account numbers, and account balances; the bank said its core banking system | Disclosed | B · Reported |
| 🇦🇺 LandMark Whitebreach.co.nz/breach/au-2019-landmark-white | 2019-01 | Not disclosed | Property-valuation records containing borrowers' and owners' personal contact details; about 137,500 valuation records exposed and later leaked on a dark-web forum | Before the courts | B · Reported |
Reading this briefing
Tier A — Confirmed: a regulator or court has acted or published. Tier B — Reported: the organisation’s own disclosure or credible media, awaiting official confirmation. “People affected” is what the organisation or regulator disclosed; “Not disclosed” means no official figure exists, and we don’t estimate. Totals add disclosed figures only and may overlap.
breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.