Your ad hereSponsor the Healthcare briefing — the header banner on every printed and downloaded copy.
breach@govern.co.nz🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/sector/healthcare/print/
breach.co.nz/sector/healthcare/print/
🏥 Healthcare: reported data breaches
Every healthcare breach in the breach.co.nz register, New Zealand and Australia, 2019–2026. Each line is a public record; follow the short link to see the sources.
18records
14M+people affected (disclosed, 5 of 18)
7 · 11NZ · AU
4confirmed by regulator / court
1penalties or court action
Largest by people affected
- MediSecure — 12,900,000 (approx) · AU · 2024-04
- Tū Ora Compass Health — 1,000,000 (approx) · NZ · 2019-08
- Australian Clinical Labs — Medlab Pathology — 223,000+ · AU · 2022-02
Suppliers named in these records: HotDoc (1) · CTARS (1) · Accellion FTA (1). A supplier appearing here is not a finding against that supplier — see each record.
All 18 records
| Organisation | Breach | People | Data reported | Status | Tier |
|---|---|---|---|---|---|
| 🇳🇿 Zenith Technology Corporation Limited — ZenTechbreach.co.nz/breach/zentech-zenith-technology-dunedin | 2026-08 | Not disclosed | Reported; Up to 67.1GB of data taken, including files owned by Health NZ and third parties | Disclosed | B · Reported |
| 🇦🇺 Partnered Health — national GP clinic networkbreach.co.nz/breach/au-2026-partnered-health | 2026-06 | Not disclosed | Names, dates of birth, addresses, contact details; Medicare numbers | Disclosed | B · Reported |
| 🇦🇺 Ochre Health (Tuggeranong)breach.co.nz/breach/au-2026-ochre-health | 2026-06 | Not disclosed | Unauthorised access limited to two accounts on the HotDoc third-party booking platform; Name, address, email, phone number, date of birth, gender and limited appointment/booking information | Disclosed | B · Reported |
| 🇳🇿 Manage My Healthbreach.co.nz/breach/nz-2025-manage-my-health | 2025-12 | 100,000 (approx) | Patient health records and personal information | Regulator action taken | A · Confirmed |
| 🇦🇺 Genea Fertilitybreach.co.nz/breach/au-2025-genea | 2025-01 | Not disclosed | Full names, addresses, phone numbers, dates of birth, Medicare card numbers, medical diagnoses and clinical data | Disclosed | B · Reported |
| 🇳🇿 Health New Zealand — Te Whatu Ora (staff data)breach.co.nz/breach/nz-2024-health-nz-staff | 2024-10 | Not disclosed | Staff occupational health and safety information, including medical assessments and health-related correspondence | Disclosed | B · Reported |
| 🇦🇺 I-MED Radiology Networkbreach.co.nz/breach/au-2024-imed | 2024-09 | Not disclosed | Patient names, dates of birth, sex, addresses, scan type and date, referring physician, and some medical reports and scan images | Disclosed | B · Reported |
| 🇦🇺 MediSecurebreach.co.nz/breach/au-2024-medisecure | 2024-04 | 12,900,000 (approx) | Names, dates of birth, contact details, healthcare identifiers, Medicare and concession card numbers, medication details and reasons for prescription | Disclosed | A · Confirmed |
| 🇳🇿 Health New Zealand (Te Whatu Ora)breach.co.nz/breach/nz-2023-health-nz | 2023-11 | 12,000 (approx) | Personal information of COVID-19 vaccinators | Disclosed | B · Reported |
| 🇦🇺 TissuPathbreach.co.nz/breach/au-2023-tissupath | 2023-08 | Not disclosed | Names, dates of birth, gender, contact details, Medicare numbers, private health insurance details and referring-doctor details on scanned pathology referrals issued 2011–2020 | Disclosed | B · Reported |
| 🇳🇿 Pinnacle Midlands Health Networkbreach.co.nz/breach/nz-2022-pinnacle-midlands | 2022-09-28 | Not disclosed | Patient addresses and National Health Index; Immunisation and screening status, and data about services provided | Disclosed | B · Reported |
| 🇦🇺 CTARS (NDIS client-management provider)breach.co.nz/breach/au-2022-ctars-ndis | 2022-05-15 | Not disclosed | Names, dates of birth, addresses, phone numbers, emails, usernames/passwords and genders; Sensitive health and disability data | Disclosed | B · Reported |
| 🇦🇺 Australian Clinical Labs — Medlab Pathologybreach.co.nz/breach/au-2022-australian-clinical-labs | 2022-02 | 223,000+ | Personal information including contact details, health information and credit card/payment details; Medicare card numbers | Penalty issuedAUD 5.8M | A · Confirmed |
| 🇳🇿 Waikato DHB (Te Whatu Ora Waikato)breach.co.nz/breach/nz-2021-waikato-dhb | 2021-05-18 | Not disclosed | Patient and staff personal and health information | Disclosed | A · Confirmed |
| 🇦🇺 NSW Healthbreach.co.nz/breach/au-2021-nsw-health | 2020-12 | Not disclosed | Identity information and, in some cases, health-related personal information contained in files accessed; NSW Health said medical-records systems were not affected | Disclosed | B · Reported |
| 🇦🇺 Ambulance Tasmaniabreach.co.nz/breach/au-2020-ambulance-tasmania | 2020-11 | Not disclosed | Incident addresses, age, gender and the medical condition or nature of the callout | Disclosed | B · Reported |
| 🇦🇺 Regis Healthcarebreach.co.nz/breach/au-2020-regis-healthcare | 2020 | Not disclosed | Personal data copied and in part published; reporting referenced residential care and accommodation agreements and resident information | Disclosed | B · Reported |
| 🇳🇿 Tū Ora Compass Healthbreach.co.nz/breach/nz-2019-tu-ora | 2019-08 | 1,000,000 (approx) | Potentially exposed: enrolment details, NHI numbers, names, dates of birth, ethnicity, addresses, and some immunisation, diabetes, vaccination and screening information | Disclosed | B · Reported |
Reading this briefing
Tier A — Confirmed: a regulator or court has acted or published. Tier B — Reported: the organisation’s own disclosure or credible media, awaiting official confirmation. “People affected” is what the organisation or regulator disclosed; “Not disclosed” means no official figure exists, and we don’t estimate. Totals add disclosed figures only and may overlap.
breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.