The private information of 24 New Zealanders registered with a now defunct cryptocurrency trading site has been found on the dark web.
Photo: 123RF
About 5000 driver licences, passports and other data held by AlphaEx, which wound up in August last year, have been published online.
Cyber support charity IDCARE has not been able to get hold of AlphaEx or any of the affected New Zealanders.
IDCARE Identity security operations centre head Moises Sanabria said it happened more than people realised.
"What happens sometimes is individuals that own these companies just abandon the site and the site still continues to harvest information or to register individuals who think that they're still working.
"And because they've abandoned the site, then obviously the security is not that great anymore, or the updates are no longer in place and people find backdoors or back ways to access that information which is probably what has occurred here."
Privacy breaches were more likely to happen for firms that were no longer operational, he said.
"When a company goes down or into insolvency and they give up, they don't really care about any further consequences.
"And even though the front door, saying, we're no longer in business, what occurs is the mess that's left in the back ... because people's data is there."
The Office of the Privacy Commissioner encourages New Zealanders who may have been affected to contact IDCARE as soon as possible, and to visit www.privacy.org.nz for further information and resources on privacy rights and responsibilities in New Zealand.