COVID-19 Data Breach Impacts 12,000 People, Vaccinators’ Details Also Leaked

Color4260/Shutterstock

The personal details of 12,000 New Zealanders have been leaked on an American website as a result of a data breach at Te Whatu Ora, the government department responsible for delivering health services.

An investigation began in December last year after it was found that 56-year-old health worker Barry Young—who also goes by the name Winston Smith—had accessed and used the data to spread vaccine misinformation. He was subsequently sacked, arrested, and charged with unauthorised disclosure and misuse of data. He is currently awaiting trial and faces a maximum penalty of seven years in jail.

Interviewed on a New Zealand website, he said he had developed a database for the vaccine rollout, and quoted data from that work. It’s understood that the alleged misinformation centres around the number of vaccine-related deaths. Authorities say that in New Zealand, there have been only four deaths linked to the COVID-19 vaccination since it was introduced.

Initially Thought to Affect a ‘Small Number’

After the breach came to light in December, Te Whatu Ora initially said there was a chance “a small number of people” had been identified, but it appears this was grossly underestimated.

An injunction issued by the Employment Relations Authority prevents any publication of the data, and Te Whatu Ora had already used it to have information taken down from one overseas website.

When Te Whatu Ora found out about the latest breach on the United States’ blog site, it asked for the information to be removed. Eventually, it was taken down.

The site allowed people to download the details as a single file. It’s not known how many downloads occurred before the file was taken down.

It included details of “a large number” of COVID-19 vaccinators, Te Whatu Ora said.

Margie Apa, the organisation’s chief executive, said people whose personal information had been disclosed would start to be contacted today. It was hoped that more than half of those affected would have been contacted by the end of the coming weekend.

Te Whatu Ora (Health NZ) CEO Margie Apa. Courtesy Te Whatu Ora

Vaccinators and Vaccinated Are On The List

“There is also a small group of vaccinated people who, through the use of considerable effort and technical expertise, could potentially be identified within information earlier made publicly available,” Ms. Apa confirmed.

“We deeply regret what happened and apologise sincerely to those affected. We are making information, advice and support available to individuals being notified.”

This would involve individually locating and notifying each person, which would take time to do, she said.

Ms. Apa described it as a “highly complex” situation, and the investigation was ongoing.

“We are working with local and international cyber security experts to assist and monitor for signs of the data being disclosed online,” she said.

She reiterated that Mr. Young “has no clinical background or expert vaccine knowledge” and appeared to be “trying to spread misinformation.”

“What this individual is trying to claim about vaccines is completely wrong and ill-informed and their comments demonstrate this.

“We assure people there is no evidence whatsoever that vaccination is responsible for excess mortality in New Zealand.”

Mr. Young’s LinkedIn page describes him as a senior database administrator.

Te Whatu Ora’s cybersecurity team will continue scanning for any other places where the information appears.

Te Whatu Ora said it is working closely with other agencies, including the National Cyber Security Centre, the Police, the Department of Internal Affairs, and the Office of the Privacy Commissioner.