Some cases are delayed as investigation continues, justice ministry says
Regarding the cyber attack against the computerised servers of Zenith Technology Corporation Ltd (ZenTech) discovered in August, the Ministry of Justice shared that the incident did not target it or the court systems, but did affect certain Coroners Court information.
In its statement, the justice ministry explained that the Coroners Court information impacted by the cyber security incident concerned cases in the Otago/Southland region, mostly from 2016–22.
According to the justice ministry, delays have hit a small number of ongoing cases as the investigation into the incident remains pending.
In its statement, the justice ministry said it is cooperating with the agencies involved, including Health NZ and the police, in connection with this matter. They are looking into which information the cyber incident has affected and how it ended up with ZenTech.
Regarding its work with the police, the justice ministry said it is seeking to assess and examine the information involved. The justice ministry acknowledged the need for further validation to identify the cases impacted.
“We acknowledge that this development will be concerning for families who may be worried that information about them or their loved one is involved,” the justice ministry stated.
According to the justice ministry, affected families can use the dedicated phone line that it created if they are worried that the breach has affected a relative’s case. Per the justice ministry, the phone line accepts calls from 8 a.m. to 5 p.m. on weekdays.
“Due to an ongoing police investigation, and the sensitivity of the information involved, we are unable to comment further at this time,” the justice ministry stated.
In a 25 September 2026 judgment, the High Court of New Zealand specified the terms for an interim injunction issued over the data of Health NZ and ZenTech derived from or obtained in the cyber attack against ZenTech’s servers in or around August 2026.
The interim injunction prohibited access to, use of, or publication of the confidential information unlawfully taken from the servers during the incident.
In another matter, Privacy Commissioner Michael Webster issued compliance notices to Manage My Health (MMH) and Health NZ for failing to adhere to the security requirements of r 5 of the Health Information Privacy Code 2020 during a cyber incident in late December 2025.
On 27 May 2026, in the results of the first phase of his independent inquiry into the cyber incident, Webster found that MMH and Health NZ had breached the Privacy Act 2020.
Enjoy this story? Read the latest TMT (telecoms, media, technology) news on the main page!
