Your ad hereSponsor the Other briefing — the header banner on every printed and downloaded copy.
breach@govern.co.nz🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/sector/other/print/
breach.co.nz/sector/other/print/
🗂️ Other: reported data breaches
Every other breach in the breach.co.nz register, New Zealand and Australia, 2020–2026. Each line is a public record; follow the short link to see the sources.
12records
6.2M+people affected (disclosed, 4 of 12)
3 · 9NZ · AU
1confirmed by regulator / court
0penalties or court action
Largest by people affected
- Qantas — 5,700,000 (approx) · AU · 2025-06-28
- MediaWorks — 403,000 (approx) · NZ · 2024-03
- Nissan Oceania — 100,000 (approx) · AU · 2023-12-05
Suppliers named in these records: Stafflink (1). A supplier appearing here is not a finding against that supplier — see each record.
All 12 records
| Organisation | Breach | People | Data reported | Status | Tier |
|---|---|---|---|---|---|
| 🇦🇺 Melbourne International Film Festivalbreach.co.nz/breach/au-2026-miff | 2026-05 | 26,782+ | Names, email addresses, phone numbers and residential addresses; MIFF said no credit-card information or account passwords were accessed, and that the dataset does not include purchase history, booking totals or membership details | Disclosed | B · Reported |
| 🇦🇺 Metricon Homesbreach.co.nz/breach/au-2025-metricon | 2025-07 | Not disclosed | Not confirmed by Metricon. The Qilin ransomware group claimed to have stolen employee details, finance/HR documents and credit-card receipts | Disclosed | B · Reported |
| 🇦🇺 Qantasbreach.co.nz/breach/au-2025-qantas | 2025-06-28 | 5,700,000 (approx) | About 4 million records: names, phone numbers, email addresses and Frequent Flyer details; About 1.7 million of those records also included one or more of address, date of birth, gender and meal preferences | No further action | A · Confirmed |
| 🇦🇺 The Fullerton Hotel Sydneybreach.co.nz/breach/au-2025-fullerton-hotel-sydney | 2025-03 | Not disclosed | Employee records and the credit-card details of a small number of guests; Attacker claim | Disclosed | B · Reported |
| 🇦🇺 Compass Group (Australia)breach.co.nz/breach/au-2024-compass-group | 2024-09 | Not disclosed | Some data taken from part of the IT network; The Medusa group claimed the data includes employee wage declarations and passport and driver's licence scans | Disclosed | B · Reported |
| 🇳🇿 MediaWorksbreach.co.nz/breach/nz-2024-mediaworks | 2024-03 | 403,000 (approx) | Name, date of birth, gender, postal address/postcode, email and phone number; in some cases images or videos submitted with competition entries. MediaWorks said no passwords, ID documents or financial data were involved | Disclosed | B · Reported |
| 🇦🇺 Nissan Oceaniabreach.co.nz/breach/au-2023-nissan-oceania | 2023-12-05 | 100,000 (approx) | Government ID for up to ~10% of those affected | Disclosed | B · Reported |
| 🇦🇺 DP World Australiabreach.co.nz/breach/au-2023-dp-world | 2023-11 | Not disclosed | Personal information of current and former employees | Disclosed | B · Reported |
| 🇦🇺 Harcourts Melbourne Citybreach.co.nz/breach/au-2022-harcourts | 2022-10 | Not disclosed | Names, addresses, bank details and signatures; Photo identification of prospective renters | Disclosed | B · Reported |
| 🇳🇿 AA Travellerbreach.co.nz/breach/nz-2021-aa-traveller | 2021-08 | Not disclosed | Names, addresses and contact details; For older records, expired credit-card numbers held on a legacy system | Disclosed | B · Reported |
| 🇳🇿 Air New Zealand — Airpointsbreach.co.nz/breach/nz-2021-air-nz-airpoints | 2021-02 | Not disclosed | Names, tier status and Airpoints membership numbers | Disclosed | B · Reported |
| 🇦🇺 Toll Groupbreach.co.nz/breach/au-2020-toll-group | 2020-05 | Not disclosed | Personal information of past and present employees; Details of commercial agreements with current and former enterprise customers | Disclosed | B · Reported |
Reading this briefing
Tier A — Confirmed: a regulator or court has acted or published. Tier B — Reported: the organisation’s own disclosure or credible media, awaiting official confirmation. “People affected” is what the organisation or regulator disclosed; “Not disclosed” means no official figure exists, and we don’t estimate. Totals add disclosed figures only and may overlap.
breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.