File photo. Te Whatu Ora chief executive Margie Apa Photo: RNZ / Samuel Rillstone
The leak of Te Whatu Ora vaccine-related information online is a "devastating breach of trust", the organisation's chief executive Margie Apa says.
The health agency had resecured systems and was continuing to scan the internet and media for any further appearance of the data.
The staff member accused of leaking the data was due to appear in Wellington District Court on Monday, charged with accessing a computer system for dishonest purposes.
In a statement, Te Whatu Ora chief executive Margie Apa said the individual allegedly downloaded a large amount of vaccine-related information which was then published on an overseas site.
The person had no clinical background or expert vaccine knowledge and appeared to be trying to spread misinformation, she alleged.
Te Whatu Ora found out about the breach on Thursday morning through an email an individual had sent to a number of officials, she told Morning Report.
"Basically that he had information that suggested there were excess mortalities due to the Covid vaccine that were not reported, and purported to have made connections to data that proved that, which is not true."
The data had been taken down from the overseas website and an Employment Relations Authority injunction was preventing it from being published elsewhere.
The data seemed to be "large amounts of vaccine-related information" and appeared to have been anonymised, Apa said. Analysis was continuing, but so far no NHI numbers or personally identifiable information was believed to have been released.
"We have taken action since Thursday morning to resecure our whole system, which includes resetting a whole lot of access codes.
"We're scanning the international internet and web and media to look for data that looks like ours appearing, which is how we picked up the US-based website on Friday midnight."
She said the leak was an "isolated incident" and a "devastating breach of trust".
The man facing charges had worked in a small team of specialised people who were "incredibly devastated" by what happened.
Apa said said misinformation about vaccines was particularly concerning at a time when Covid-19 cases were high.
"Rates are going up, we are seeing hospitalisations so we really want to keep promoting to New Zealanders who are eligible for Covid boosters to get them."
Disinformaton Project director of research Sanjana Hattotuwa said the situation was unprecedented for New Zealand.
"It is the most significant event or development on social media since the start of the Disinformation Project's study on what the [World Health Organization] calls the infodemic, which is the disinformation, misinformation around Covid-19."
Political reaction
Labour's leader Chris Hipkins said the data breach was concerning.
"All government agencies who hold people's personal information do so with a degree of trust from the public, and they need to very scrupulously make sure they're protecting that data, so this is very concerning.
"I think it's partly about people vetting," he said, as well as technological solutions as well as systems such as multiple authorisations.
Opposition health spokesperson Ayesha Verrall said the response had been swift, and she would be asking questions of the new health minister to ensure the breach had been handled properly.
"New Zealanders give their health information to Te Whatu Ora in order to make sure that they are cared for appropriately. When it is used for another purpose and that purpose is vexatious, then that is of course of concern," she said. "It's a matter before the courts, I don't want to speculate."
Hipkins said the public sector would need to guard vigorously against breaches of personal and private data.
"I am pretty concerned about some of the momentum that seems to be building behind some of these conspiracy theories .... they're not grounded in fact".
He said the new government seemed to be "giving a bit of a nod to the conspiracy theorists".
"Things like their reservations about the World Health Organisation actually putting in place steps to stop future pandemics. I think that will embolden the conspiracy theorists."
Health Minister Shane Reti in a statement last week said government's decision to hold off on agreeing to health regulation amendments, which would shorten the time allowed for countries to opt out of changes to one year rather than two, was to ensure a national interest test was conducted.
"The only way to give effect to this is to formally reject the amendments. Rejections may be withdrawn by New Zealand at any time, after which the amendments would come into force," he said.
"Reserving against provides for a pause on New Zealand's response to amendments suggested by the WHO, while they're considered against a national interest test. This is an interim position to give the new government the opportunity to receive advice and fully consider the amendments."
