Cyber Incident Victim: New Zealand Nurses Organisation
Date:
Nov 2016
Location:
New Zealand
Summary
The New Zealand Nurses Organisation experienced a data breach when a staff member fell victim to a spear phishing email impersonating its chief executive, resulting in the accidental disclosure of first names, surnames, and email addresses belonging to 47,000 members. The organization promptly notified affected individuals, relevant authorities including law enforcement and IDCare, and attempted unsuccessfully to retrieve the compromised data through its IT team and the email provider. While no financial or additional personal information was exposed, IDCare assessed a moderate risk of members receiving phishing emails due to the incident. The breach highlighted vulnerabilities to targeted phishing attacks despite organizational efforts to address the situation transparently.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around November 1, 2016, the New Zealand Nurses Organisation (NZNO) experienced a data breach affecting approximately 47,000 members. The incident occurred when an NZNO staff member received a spear phishing email impersonating the organization's chief executive, requesting names and contact details of all members. Believing the request to be legitimate, the staff member compiled and sent a file containing members' first names, surnames, and email addresses to the fraudulent email account. The organization's IT team later attempted to recall the email and contacted Yahoo, the email service provider associated with the recipient address, but these retrieval efforts were unsuccessful. NZNO promptly reported the incident to New Zealand Police, the Office of the Privacy Commissioner, and the Department of Internal Affairs following discovery of the breach.
The compromised dataset contained no financial information or other sensitive personal details beyond names and email addresses. NZNO notified all affected members via email about the breach and engaged IDCare, a nonprofit identity support service, to provide assistance. IDCare assessed the risk level as moderate, warning that members could become targets of phishing campaigns leveraging the exposed information. The organization maintained open communication with privacy regulators throughout the response process. No evidence suggested further dissemination of the data beyond the initial recipient at the time of reporting, though the criminal nature of the recipient's intent remained a primary concern. The breach originated entirely from the successful deception of staff through a targeted email impersonation attempt rather than technical system vulnerabilities.