Breach ‘very disappointing’ — Ardern
Prime Minister Jacinda Ardern says a major government security breach is “very disappointing” after private details of hundreds of young New Zealanders, including passports, birth certificates and drivers’ licence details, were exposed on a website.
The youth gave their details to the Ministry of Arts, Culture and Heritage when they applied to sail on the double-hulled canoe Fa’afaite, as part of the Tuia 250 commemorations marking 250 years since James Cook landed in New Zealand.
A parent alerted the ministry to the breach. It has apologised, saying the breach is “completely unacceptable”.
“The breach — which happened as a result of an information management issue — means identity documents, and other personal information, were able to be accessed via the Tuia 250 website,” Ardern said. “This is very disappointing, and Manatu¯ Taonga will be commissioning an external review to determine how this occurred. It is too early for me to comment further.”
All those affected have been contacted, officials say.
Ministry chief executive Bernadette Cavanagh and the Government’s chief digital officer, Paul James, outlined the details of the breach in Wellington yesterday.
The breach was discovered on Thursday and the website, a special one set up for the purpose, was shut down on Friday.
Explaining in detail how the breach was detected, Cavanagh said someone had been fraudulently trying to buy a ticket, believed to be a concert ticket, online using the driver licence ID of one of the applicants for Tuia 250.
The vendor of the ticket thought something was not quite right so contacted the holder of the licence and confirmed that the holder was not the person trying to buy the ticket. Police are investigating.
Cavanagh said she sincerely apologised to those affected by the breach, saying it was a “coding error”.
She said that while the trip was open to people aged 16 to 75, most applicants were aged 16 to 20.
Cavanagh said investigators didn’t think it was a targeted attack on the website, “but rather an opportunistic finding of information that wasn’t as secure as it should have been”.
The ministry has started specialist security investigations to identify the scope of the breach.