🏥 Healthcare — data breaches

Reported (unconfirmed): files attributed to ZenTech identified online; ZenTech acknowledged only sample material purported to be company data, Up to 67.1GB of data taken, including files owned by Health NZ and third parties (as described in High Court interim-injunction proceedings, as reported), Some Coroners Court information (Otago/Southland, mostly 2016–2022)

None announced (Police investigating)

Reported

Names, dates of birth, addresses, contact details, Medicare numbers, Private health insurance / DVA / concession card numbers

OAIC (notified)

Reported

Unauthorised access limited to two accounts on the HotDoc third-party booking platform (Tuggeranong clinic), Name, address, email, phone number, date of birth, gender and limited appointment/booking information (date and time, practitioner, consult type); no clinical records or treatment notes, Claimed by a threat actor, not confirmed by Ochre: Medicare numbers, DVA numbers and billing information

OAIC and ACSC (informed)

Reported

Patient health records and personal information

NZ Privacy Commissioner (inquiry concluded; compliance notices issued)

Confirmed

Full names, addresses, phone numbers, dates of birth, Medicare card numbers, medical diagnoses and clinical data (per Genea's patient notifications, July 2025, as reported); data published externally

OAIC (representative complaint lodged Nov 2025)

Reported

Staff occupational health and safety information, including medical assessments and health-related correspondence (2020–2024)

NZ Privacy Commissioner (notified); NZ Police Cybercrime Unit investigating

Reported

Patient names, dates of birth, sex, addresses, scan type and date, referring physician, and some medical reports and scan images (as reported; 'tens of thousands of patients' is a media estimate). I-MED said its preliminary investigation did not indicate significant unusual access to patient records

OAIC (notified, per I-MED)

Reported

Names, dates of birth, contact details, healthcare identifiers, Medicare and concession card numbers, medication details and reasons for prescription (~6.5TB of data)

OAIC (inquiries closed; no investigation)

Confirmed

Personal information of COVID-19 vaccinators (file posted on a US-based blog); altered/anonymised vaccination data published overseas, from which a small number of vaccinated people could potentially be identified

NZ Privacy Commissioner (notified)

Reported

Names, dates of birth, gender, contact details, Medicare numbers, private health insurance details and referring-doctor details on scanned pathology referrals issued 2011–2020 (referrals relating to patients undergoing cancer checks); TissuPath said billing information and its patient-diagnosis database were not compromised

OAIC and ACSC (notified)

Reported

Patient addresses and National Health Index (NHI) numbers, Immunisation and screening status, and data about services provided

NZ Privacy Commissioner (notified)

Reported

Names, dates of birth, addresses, phone numbers, emails, usernames/passwords and genders, Sensitive health and disability data

OAIC and ACSC (notified)

Reported

Personal information including contact details, health information and credit card/payment details, Medicare card numbers, Medical & pathology results

OAIC

Patient and staff personal and health information (leaked to media / dark web)

NZ Privacy Commissioner

Confirmed

Identity information and, in some cases, health-related personal information contained in files accessed; NSW Health said medical-records systems were not affected

None reported

Reported

Incident addresses, age, gender and the medical condition or nature of the callout

None reported

Reported

Personal data copied and in part published; reporting referenced residential care and accommodation agreements and resident information

OAIC and ACSC (notified)

Reported

Potentially exposed: enrolment details, NHI numbers, names, dates of birth, ethnicity, addresses, and some immunisation, diabetes, vaccination and screening information (no GP notes)

NZ Privacy Commissioner (notified)

Reported