News: 24 August 2019
For Tuia 250 Voyage Trainee programme applicants affected by the digital privacy breach
We are very sorry.
We contacted you directly by phone, or attempted to on Saturday 24 August.
To get in touch with us about this issue, please contact:
Phone: 04 499 499 (this is MCH’s reception, please ask to speak to someone about the privacy breach)
You can view the media release here.
Q + A's
Manatū Taonga Ministry for Culture and Heritage has discovered that some information provided by applicants for the Tuia 250 Voyage has been available on the internet and has been accessed and copied by third parties.
What documents were available on the internet?
Images of identity documents provided as part of the Tuia 250 Voyage Trainee application process eg, passports, driver’s licences, birth certificates and other forms of identification.
What has the Ministry done about this?
All personal information has now been removed from the Tuia 250 website and we are continuing to work on ensuring it is not available anywhere else. The original Tuia 250 website has been shut down, and a new site has been created. You can find it here. A cross-government support group has been formed to offer support to those affected. An external review will take place to see what went wrong in this case and ensure that the Ministry’s processes are robust.
Was this a malicious attack on the website?
Advice from our security investigators is that this wasn’t a targeted attack on the site, but rather an opportunistic find of information that wasn’t as secure as it should have been.
What does this mean for people who are impacted by this?
There is a risk that identity documents provided may have been obtained by somebody else and therefore could be used fraudulently.
How many people were impacted?
302 people are impacted. These people applied for the Tuia 250 Voyage Trainee programme through the website.
What are you doing about reissuing the documents?
We are moving as quickly as possible to reissue documents, at our cost. To do this we need to pass on the information to the relevant agencies (such as, the Department of Internal Affairs for passports).
What if NZ passport details were provided?
Department of Internal Affairs (DIA) will reissue passports. Those affected should get in touch at firstname.lastname@example.org
What if a foreign passport was provided?
Contact your local Embassy, High Commission, or Consulate to seek advice about a replacement passport. If you replace your passport you will also need to have your New Zealand visa transferred to your new passport. To do this, please contact Immigration New Zealand once you have received your replacement passport. The New Zealand government will refund the replacement fees.
For a list of all representatives to New Zealand under “Foreign representatives to New Zealand” at https://www.mfat.govt.nz/en/embassies/
Immigration New Zealand’s contact centre at 0508 558 855 or + (64) 9 914 4100 or www.immigration.govt.nz
What if a birth certificate or information from another source (school, doctor, or another person) was provided?
If a copy of your birth certificate or information from another source, eg your school, doctor or another person, provided any replacement would be the same as the one you have now. These documents do not need to be reissued.
What if a driver’s license was provided?
New Zealand Transport Agency (NZTA) will replace it for you at no cost. Contact email@example.com for further information.
How do I report fraud or cybercrime?
Contact the Police if you believe your identity may have already been used in a fraudulent way firstname.lastname@example.org
The Police Cybercrime Unit has provided the following reference for any applicants to add to their police report - HTCG191139.
CERT NZ has some helpful advice around online identity theft. See: https://www.cert.govt.nz/individuals/explore/online-identity-theft/?topic=online-identity-theft
Will criminals use these documents to hack accounts of applicants?
The breach doesn’t necessarily open any doors to criminals to access accounts already created, but can be used to create new online identities and cause harm.
Remember that the details in these personal IDs are often used to confirm your identity if you have forgotten a password or login details. Changing these answers to a known but incorrect answer is a good idea.
If you have one, it may be of value to keep an eye on your credit rating, and some information around that is available at: https://www.govt.nz/browse/consumer-rights-and-complaints/debt-and-credit-records/check-your-own-credit-report/
It may be worthwhile being extra vigilant with your bank accounts in the near future. Any suspicious transactions should be reported immediately.
Where can I get some more advice about cyber security?
Some other basic cyber security advice can be found at:
This includes simple things like using different passwords on each platform and utilising two factor authentication where available.
Are people affected by this breach more susceptible to scams now?
It’s possible they may be contacted by people trying to scam them or obtain further information. Challenge or ask for further information, such as calling them back at the organisation they state they are from.
Are the Police involved?
The Police cybercrime unit is collating the New Zealand Police response to this situation. They have provided the reference number HTCG191139 for any applicants to add to their police report.
Who can I contact if I have a question?
Call MCH and ask for Tuia Support on 04 499 499 or email email@example.com
Why were people asked to upload their documents?
We needed to check applicants were aged 16 or over to be eligible to participate. We also wanted to separate 16 to 18 year olds out from people aged 19 and over, and assign them to different vessels and voyage legs accordingly.
How long have documents been available online?
Potentially since June 2019.
Updated on 18th December 2019