ZenTech hack reaches southern coronial files, and the Justice Ministry doesn't know how they got there

Some Coroners Court files from Otago and Southland were caught up in the ransomware attack on Dunedin firm Zenith Technology (ZenTech), the Ministry of Justice has confirmed. The ministry has no contract with the company, B2B News reported.

In a release dated 27 October 2026, chief operating officer Carl Crafar said the affected information relates to Otago/Southland cases, "largely between 2016 and 2022". The ministry said it still needs to check which cases are affected. It also said the incident did not target ministry or court systems.

The ministry said it is working with Health New Zealand, police and other agencies to find out how the information came to be with the company and exactly what it includes.

Health NZ describes ZenTech as a privately owned, Dunedin-based contract research organisation that does clinical-trial work with Health NZ and the wider health sector. B2B News, citing Stuff, said the firm provides clinical trial and lab services to the pharmaceutical industry.

One Dunedin family has waited 36 weeks for a coronial finding into the unexpected death of their 73-year-old mother, B2B News reported, citing Stuff. A case manager told them the case was "hindered by a cyber attack experienced in Dunedin" and that the files were in "digital quarantine". Her daughter called it "incredibly unfair and exhausting". Another family, nine months into their wait, called it "incredibly stressful".

The ministry's release says only "a small number of current cases" have been delayed while the incident is investigated. It doesn't say how many.

Families worried that a relative's case is affected can call the ministry on 0800 638 924, weekdays from 8am to 5pm.

The release also says the High Court recently granted an interim injunction. It bars anyone from accessing, using or publishing confidential information taken unlawfully from ZenTech's servers. In practice, that means media outlets and anyone else who finds the leaked files online can't legally use them.

A group called ZaWoo claimed the attack. According to B2B News, it posted names, addresses and blood test results on the dark web on 31 August and demanded a bitcoin ransom.

On 10 September, 1News reported that a ZenTech spokesperson said some systems had been taken offline as a precaution, and that the company knew sample material said to be its data had been published online. Police said they were in the early stages of an investigation and working with Health NZ. Health Minister Simeon Brown had been briefed and was getting regular updates, 1News reported.

Health NZ said it found out about the incident after files attributed to ZenTech were found online. It said its own digital systems were not affected.

In September, ZenTech said it was still assessing the extent of any impact, 1News reported. B2B News reported that the company did not respond to Stuff's request for comment.

It is the second hack in four years to reach coronial records. In December 2022, ransomware hit Wellington managed IT provider Mercury IT. According to B2B News, it blocked access to about 14,500 coronial files and around 4,000 post-mortem reports. In 2023, the ministry confirmed that no coronial files were among the Mercury IT material released on the dark web.

Mercury IT held the files as a supplier to government agencies. The ministry has no contract with ZenTech, B2B News reported.

The delays also add to an existing backlog. The ministry's 2022–23 annual report recorded more than 6,000 active coronial cases, and Budget 2022 put $28.5 million in operating funding towards reducing coronial delays, B2B News reported.