Police have charged a worker at the New Zealand Transport Agency, and the worker has been sacked after the personal details of 44 customers were accessed unlawfully.
The details accessed include driver licence numbers, number plates and home addresses.
The agency, also known as Waka Kotahi, first became aware of the privacy breach in late 2018, but only now - more than two years on - has informed the affected people about what's happened.
NZTA customer Michael Rowley is one of those who had their personal information illegally accessed - he says, the breach is serious.
"Definitely it's serious for myself and the 44 others because it's all the key aspects of your identity."
Included in the harvest of information, were:
- Vehicle plate numbers
- Vehicle make and model
- Full name of the affected customers
- Date of birth
- Gender
- Driver licence number
- Customer number
NZTA knew about the privacy breach in October 2018. It dismissed the worker then but the customers were only told recently.
- If you have more information, email Michael Morrah in confidence at michaelmorrah@tv3.co.nz
"Which really surprised me because we're now in 2021," Rowley says.
"I'm very annoyed and very worried."
The Transport Agency told Newshub it didn't notify the affected 44 individuals earlier because it wanted to avoid potentially compromising the police investigation. However, the agency is still warning the customers to be vigilant to the risks of identity theft, and to notify credit agencies about what's happened.
Netsafe CEO Martin Cocker says such information can be used in various ways.
"For New Zealanders, I think this will be considered relatively serious because it's a New Zealand agency and it's an inside job.
"The key thing that you do once you grab identity information is you utilise someone's identity to apply for things - money, loans, mortgages that type of thing."
Gorilla Tech CEO Paul Spain says identity theft has serious consequences.
"We hear stories of people who are dragged through courts over a long period of years after their identity has been stolen and if that has happened to any of these people then that's on NZTA."
Police have charged the NZTA worker - although Rowley says the delivery of news of the breach has come too late.
"It was disgusting at the end of the day."
The privacy commissioner has been notified of what's occurred.
