Work and Income has had to contact more than 100 clients to apologise after their email addresses were accidentally revealed to each other, potentially revealing their identities.
The privacy breach happened on Thursday afternoon when a staffer sent an email to 104 people - accidentally putting their addresses in the CC field rather than BCC.
CC stands for carbon copy, which allows all recipients to see who else received the email. BCC is 'blind carbon copy', so only the original sender knows who it was sent to.
One recipient took to social media site Reddit to say they were "disappointed".
Liz Jones, Work and Income chief executive service delivery told Newshub the department was "really concerned this has happened".
"On Thursday afternoon, an email was sent by an MSD staff member to 104 clients with all of the email addresses visible to those who were copied in. No other personal client details were shared.
"Although this was a mistake, the staff member did the right thing by informing their manager as soon as they realised it had occurred."
She said Work and Income would be "getting in touch with all of the affected clients as soon as possible to apologise for the mistake".
The Reddit user said they received a call of apology, pleased with the outcome.
"If they take genuine steps to prevent it happening again there isn't anything else I would want out of it."
On Friday Work and Income made headlines after social media users complained a poster was offensive to the disabled community. The poster would be removed, Jones said.
