Law firm took six months to report email hack it didn't recognise as a privacy breach
A New Zealand legal practice found in May 2025 that someone had got into one of its email accounts. It didn't tell the Privacy Commissioner until November.
The Office of the Privacy Commissioner (OPC) has published a decision note on the case, PBN4406 [2026] NZPrivCmr 2. A VitalLaw Cybersecurity Policy Report story by Tony Foley, dated 6 October, says OPC issued it the day before. The note does not name the firm.
According to OPC, the break-in let an unknown third party reach sensitive personal information about the practice's clients. OPC said the six months it took to notify the regulator and the affected clients was a key concern.
The firm had the facts early. It received forensic findings in May 2025 but, OPC said, did not see that they also identified a privacy breach it needed to assess under the Privacy Act. It had no incident response plan for privacy breaches. Its office manager, who was responsible for privacy, had not been adequately trained.
Under section 112 of the Privacy Act, a breach is notifiable if it has caused, or is likely to cause, serious harm to the people affected. The organisation must then tell OPC and those people as soon as practicable. OPC says it expects to hear within 72 hours of an organisation becoming aware that a breach is notifiable.
Section 117(5) lets organisations notify in stages, as long as they pass on each piece of information as soon as reasonably practicable after getting it. If it isn't reasonably practicable to contact affected people directly, the organisation must give public notice instead.
One part of the note matters to any business that hands its email, IT or customer data to a contractor. OPC said information known by an organisation's employees or agents, including third-party providers, is treated as known by the organisation. So an organisation can't argue it only found out when the supplier told it. OPC says contracts with providers should require them to tell the organisation about a privacy breach.
People whose data was exposed have a remedy. If they believe an organisation didn't notify them as soon as practicable, they can complain to OPC about an interference with their privacy. The decision note does not mention any penalty or further action against the law firm.
The National Cyber Security Centre linked 162 incidents in 2025/26 to criminal or financially motivated actors, up 18% on the year before, according to IT Brief's report on the NCSC's Cyber Threat Report. They were among 369 incidents of potential national significance the NCSC dealt with. Four were classed C2, "Highly Significant". That matched the total for the previous 10 years combined.
NCSC head Catriona Robinson said, as reported by IT Brief, that these attacks "cause harm to New Zealanders whose personal information is stolen and potentially sold to other criminals or malicious actors". She also said: "Government cannot protect every organisation from every cyber threat. Leaders are responsible for cyber security within their organisations."
OPC says organisations should have an incident response plan and practise it, and should train all staff, not only the privacy officer.
OPC has a free online toolkit, Poupou Matatapu, with guidance on handling privacy breaches and writing an incident response plan. It also offers free privacy e-learning modules.