Hatch, Thankyou Payroll and Mathspace breaches show the risk of data held by suppliers

1News reported on 22 September that Hatch had told its investors that details of their income range, net asset range, cash balance and portfolio value may have been exposed. The breach didn't happen at Hatch. It happened at DriveWealth, the US-regulated broker Hatch uses to give New Zealanders access to US share markets such as the NYSE and Nasdaq.

In an email to investors reported by 1News, Hatch said an unauthorised party accessed data on DriveWealth's systems on 4 and 5 September. Some of that data related to Hatch customers. Names, addresses, phone numbers and email addresses may also have been exposed.

Passwords were not exposed. Login details sit in Hatch's own system, which wasn't breached, so customers don't need to change them. Hatch said DriveWealth was confident no unauthorised trades had been made and that holdings were not affected.

People who closed their accounts may still be affected. US regulations required DriveWealth to keep certain information for a period of time, 1News reported, so some former customers' details were still there to be taken.

Hatch has notified police and the National Cyber Security Centre (NCSC). The 1News report does not say how many New Zealanders are affected.

Thankyou Payroll's customers were also exposed through a supplier. RNZ reported that the company told users they had been caught up in a global security breach involving Metabase, an open-source analytics tool. Victoria University cybersecurity researcher Ben Van Der Weerd told RNZ that payroll firms hold a lot of personal information that "goes for a lot of money on the dark web" and can be used for further attacks and phishing.

In a special bulletin to school leaders reported by RNZ, the Ministry of Education said the breach at Mathspace, a maths learning tool used by schools, had affected more than a million users across New Zealand and Australia. It did not say how many were in New Zealand. The data may include the names and email addresses of students and teachers who used the tool. Both schools that paid for it and people using the free version may be affected.

The ministry told each school to assess its own situation and decide what it needs to do under the Privacy Act 2020. So a school whose own systems were never touched still has a legal decision to make. Mathspace has alerted the Office of the Privacy Commissioner and the NCSC, according to the ministry.

None of the reports says whether the Privacy Commissioner is investigating any of these breaches.

RNZ also reported that police are investigating a breach at health research company Zenith Technology (ZenTech), where a large number of clinical trial files may have been stolen. University of Auckland cybersecurity expert Dr Abhinav Chopra told RNZ that clinical data "cannot be changed".

The NCSC's 2026 cyber threat report says compromises in the digital supply chain caused major incidents in New Zealand over the past year. It says those incidents may have exposed personal and identity data for hundreds of thousands of users. The report doesn't name the September breaches. Its example is the May 2026 breach of Canvas, a US-owned learning management system, where criminals accessed user information and posted ransom demands on users' login pages.

Many suppliers are overseas, the NCSC says, and few New Zealand organisations are likely to know how those suppliers control access, apply security updates or encrypt data. One security failure at a vendor, whether here or overseas, can lead to several compromises of New Zealand data and systems. Attackers have repeatedly targeted the healthcare sector, where ZenTech works, trying to steal sensitive personal information held in third-party applications and use it for extortion, according to the agency.

The same failures turned up in many incidents, the NCSC found: organisations weren't using multifactor authentication, gave people more access than they needed, and didn't keep data separated. The NCSC suggests two questions for business leaders. Do they check a supplier's cyber security before buying from it? And have they planned what to do if a third-party application is breached? Hatch, Thankyou Payroll and the schools using Mathspace are now facing the second.

Individual customers have less they can do. Nobody with a Hatch account could have checked the security settings on a US broker's servers. What they can do is follow Hatch's warning. Hatch said the exposed information could make fraudulent emails, texts and phone calls more convincing. A scammer who knows an investor's name and roughly what their portfolio is worth may not sound like a scammer.