iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
A huge tranche of personal data – including children’s details – was allegedly stolen from one of New Zealand’s biggest media companies.
A member of a clear web hacking forum has claimed to have access to the personal data of more than 2.4 million New Zealanders.
According to the 14 March post, a forum user called OneERA has “stolen” 2,461,180 sets of data from MediaWorks, a New Zealand media company that owns a raft of radio stations.
“Guys, we have stolen 2,461,180 New Zealand citizens’ data from mediaworks.co.nz,” the forum post said. “We plan to sell this data, so please contact us as soon as possible if you’re interested.”
The poster goes on to describe the data in some detail, saying that it includes “names, home addresses, mobile numbers, email addresses, dates of birth, home phone numbers, user postal codes, user genders, UserIds”. The data also includes answers from questionnaires, “some citizens’ videos and music materials”, as well as “some voting and election details”.
The data may relate to The Block NZ, specifically between the years of 2017 and 2020, according to the post.
The post also includes a link to a sample of the data, which appears to be a spreadsheet containing the details of a competition to attend a rugby union match run by one of MediaWorks’ radio stations. As well as user names, emails, and addresses, the data includes the answers to several questions, including “What is your child’s name and age?” and “Do they play Rugby and, if so, what team do they play for?”
The option to share an “optional photo, video or document” is also among the questions for the competition. It is unclear if those documents are part of the leak, and the sample set of data includes 223 datasets.
Three further sample sets were subsequently posted by the same user.
MediaWorks said in a statement on its website that they are aware of the claim.
“On Friday evening (15 March), we became aware of claims that MediaWorks had been subject to a cyber security incident,” the company said.
“The claims relate to data from website competition entries. Last night, all current competition entries were moved to a new secure database.”
MediaWorks also said it “takes data security seriously, and the technology team is investigating the potential incident with the support of external experts”.
“We apologise and will provide more information as it becomes available.”
According to Radio New Zealand, as of 16 March, New Zealand’s Office of the Privacy Commissioner had not yet been notified of the possible breach.
“We expect they would do this if it were a verified breach,” the Privacy Commissioner spokesperson told RNZ.
“As with any breach, MediaWorks would need to investigate to fully ascertain the size and scope of the breach and any impact on its New Zealand clients.”
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
