MediaWorks said 403,000 New Zealanders' data was taken in competition hack

MediaWorks, a New Zealand radio broadcasting and outdoor advertising company, confirmed in March 2024 that a cyberattack had exposed the personal information of approximately 403,000 people held in a database of online competition entries dating back to 2016.

The breach surfaced on March 14, 2024, when a forum user going by the handle OneERA advertised what they said was a MediaWorks dataset for sale and published samples. The seller claimed 2,461,180 records covering New Zealanders. MediaWorks said it became aware of the claims the following day. Cyber Daily reported that the advertised data included names, home addresses, mobile and home phone numbers, email addresses, dates of birth, gender, user IDs, questionnaire responses and some video and music submissions.

The attacker's figure was far higher than the one the company later confirmed. After investigating, MediaWorks put the total at 403,000 individuals, with the stolen fields covering names, dates of birth, gender, addresses, email addresses and phone numbers, plus images or videos submitted with some entries.

The Record reported that the attackers went on to email individuals directly, demanding roughly $500 in bitcoin each to delete their records before publication. MediaWorks moved current competition entries to a new secure database, notified affected people by email and told the Office of the Privacy Commissioner and police. Chief executive Wendy Palmer said the company was reviewing its IT systems and cybersecurity measures.