The Broadcasting Standards Authority (BSA) has upheld seven complaints about an RNZ report relating to the Waikato District Health Board cyber attack last year.
In its summary, it said RNZ used information leaked in the attack in a story about a child in the care of Oranga Tamariki who was in effect living in a hospital because the agency was unable to find a place for them.
"Care must be taken to strike an appropriate balance between matters of public interest and avoiding harm," the authority noted.
It found in this case the appropriate balance was not struck because the story was unfair to the child and their family and breached their privacy.
But RNZ was not in breach of encouraging illegal behaviour or broadcasting content in bad taste, the findings continued.
The seven complaints received were from Oranga Tamariki, Waikato District Health Board, the Privacy Commissioner, the Children's Rights Alliance, and three members of the public.
RNZ has noted the decision and said it stood by its journalism, but is also seeking advice on a possible appeal.