Photo: Sebastian Gollnow / DPA / dpa Picture-Alliance via AFP
Police have arrested a man accused of leaking large amounts of Te Whatu Ora vaccination data online.
The 56-year-old man has been charged with accessing a computer system for dishonest purposes.
He will appear in Wellington District Court on Monday.
In a statement on Thursday, chief executive Margie Apa said the individual downloaded a large amount of vaccine-related information and published it on an overseas website.
The person had no clinical background or expert vaccine knowledge and appeared to be trying to spread misinformation, she said.
The data appeared to have been anonymised, she said, and so far no personal information was believed to have been compromised.
"Analysis of the released data is ongoing but work so far has not found any National Health Index Numbers or personally identifiable information."
The full extent of the breach was still being investigated, she said.
"Cyber security specialists are continuing to scan extensively for any other places where the information may appear."
Te Whatu Ora found out about the breach on Thursday morning through an email the individual had sent.
The public health agency was doing everything it could to respond and safeguard people's information, Apa said.
The data had been taken down from the overseas website and an Employment Relations Authority injuction was preventing it from being published elsewhere, she said.
"In addition, a police complaint has been laid, an employment investigation is underway, and the person is no longer at work.
"The individual has worked in the health system for a number of years. He was authorised to access data as part of his work and was locked out of our systems as soon as we became aware of the unauthorised use," Apa said.
"We take the security of our data very seriously and are extremely disappointed at this gross breach of trust by this individual and his alleged involvement in spreading harmful misinformation."
"What this individual is trying to claim about vaccines is completely wrong and ill-informed and their comments demonstrate this.
"Vaccination is safe and effective, and everyone should keep up to date with their shots to protect themselves, whānau, and their communities."
A Te Whatu Ora team had been working to address the breach over the weekend alongside other agencies such as the National Cyber Security Centre, the police, Department of Internal Affairs and Office of the Privacy Commissioner.
Advice and support had also been offered to some individual pharmacies and vaccination sites that were identified in an early video published in relation to the unauthorised disclosure and misuse of data, Apa said.
Te Whatu Ora confirmed the man was also interviewed on a New Zealand conspiracy theory site on Thursday.
The interview contained a video with apparent screenshots of the leaked information, which included the details of some pharmacies and vaccination sites.
"We are in the response stage right now and that requires very detailed analysis of the data that was released," Apa said.
"A thorough investigation is also underway to identify any learnings from this incident."