A ransomware attack on a private Dunedin company has compromised sensitive government data held without a formal contract, delayed coronial investigations, and put third-party cyber risk firmly on the agenda for New Zealand’s insurance market.
The Ministry of Justice confirmed that Coroners Court information was captured in a breach of Zenith Technologies (ZenTech), a company that provides clinical trial and laboratory services for the pharmaceutical industry and works with Health New Zealand (Health NZ). The attack, attributed to a group calling itself ZaWoo, occurred around August 2026.
The ministry “has no contract with ZenTech,” chief operating officer Carl Crafar said, and the attack did not target court systems directly.
“We are working closely with Health New Zealand, police and other agencies. This will include determining how this information came to be with ZenTech, and exactly what information is involved. A small number of current cases have experienced delays while the incident is investigated,” Crafar said.
The case puts a real-world example behind the coverage question brokers face at renewal: does a client’s cyber policy respond when the breach happens at a vendor, not at the client itself?
Third-party incidents accounted for 30% of all data breaches globally in 2025, double the 15% recorded the prior year, according to the Verizon 2025 Data Breach Investigations Report, which analysed more than 22,000 incidents across 139 countries.
Stewart Hunt, insurance adviser at First Commercial Insurance Brokers in New Zealand, told Insurance Business that “cyber insurance is one of the few covers where what’s not in the policy matters as much as what is.”
For brokers, the ZenTech case illustrates the point. A company with no direct government contract was holding sensitive public-sector data. When it was breached, the fallout reached a separate government institution and the families it serves.
Read more: Vendor risk tests the boundaries of cyber cover
The National Cyber Security Centre’s (NCSC) Cyber Threat Report 2026 found that digital supply chain compromises “have been responsible for major incidents in New Zealand,” with the healthcare sector targeted multiple times through third-party applications holding sensitive personal information.
The NCSC identified three recurring weaknesses across those incidents: lack of multi-factor authentication (MFA), over-permissioned access, and poor data separation.
The report recorded 369 incidents of potential national significance in the year to June 30, 2026. Of those, 162 were linked to criminal or financially motivated actors, an 18% increase on the prior year. Four incidents were classified C2 (Highly Significant), the first at that severity in five years.
Despite this, Aon rated New Zealand’s cyber insurance market as soft in the first quarter of 2026, citing abundant capacity and wider coverage available, as reported by Insurance Business.
Read more: NZ cyber threat rises as insurance market moves the other way
The affected information includes “some Coroners Court information relating to cases in the Otago/Southland region, largely between 2016 and 2022,” Crafar said. A dedicated phone line (0800 638 924, 8am to 5pm weekdays) has been set up for affected families.
One Dunedin family, who spoke to Stuff on condition of anonymity, said they had waited 36 weeks for answers about their mother’s death at the age of 73. In October 2026, a coronial case manager told them progress had been “hindered by a cyber attack experienced in Dunedin.”
The woman’s daughter said: “My family and I are desperate for answers about what happened to our Mum … it’s been an extremely upsetting and difficult time for us.”
On August 31, 2026, ZaWoo posted information on the dark web that purported to show sensitive patient data, including a name, address, and blood test results, according to Stuff. ZenTech was told to pay a ransom in bitcoin.
Health NZ said it was helping lead a government response “actively managed through established national incident response protocols,” with no impact on its own digital systems. Health Minister Simeon Brown was receiving regular briefings.
ZenTech said it hired cyber security specialists and obtained an interim injunction from the Wellington High Court “to prevent any external access, dissemination, sharing or posting of data involved in this incident.”
Under New Zealand’s Privacy Act 2020, any agency that experiences a privacy breach likely to cause serious harm must notify the Office of the Privacy Commissioner (OPC). The OPC recommends notification within 72 hours.
When a service provider holds data on behalf of another organisation, the OPC’s breach management guidance says the organisation holding the data bears the notification obligation. Contracts should require prompt disclosure from providers.
For brokers advising clients with third-party data arrangements, the question is whether incident response plans account for when a vendor, not the client itself, discovers the breach.
The NCSC would not confirm whether it was involved in the response. ZenTech did not respond to a request for comment by deadline, Stuff reported.
