The finding
New Zealand’s Ministry of Justice says a cyber incident at Zenith Technology Limited, known as ZenTech, involved some Coroners Court information from Otago and Southland, largely concerning cases from 2016 through 2022. The Ministry says neither its systems nor court systems were targeted. It is still trying to determine how the information came to be held by ZenTech and exactly which records were involved.
That unresolved custody question is the central failure. A breach at a clinical-research company reached beyond trial participants and into coronial records, while a small number of current cases experienced delays during the investigation. The incident demonstrates that an organization can keep its own systems outside an attack and still lose continuity and control when sensitive information has travelled to an external environment.
What happened, and when
Health New Zealand said on September 10 that files attributed to ZenTech had appeared online. It said its own digital systems and hospitals were not affected. ZenTech later acknowledged unauthorized access to part of its New Zealand IT environment and said the affected material included health-related and identifying information collected through clinical trials. The company said it contained the incident, engaged independent experts and notified Health New Zealand, police, regulators and the Office of the Privacy Commissioner.
On October 27, the Ministry of Justice confirmed that the dataset also included Coroners Court information. It said further validation was needed to establish which cases were affected and opened a dedicated phone line for concerned families. The High Court granted an interim injunction prohibiting access to, use of or publication of confidential information unlawfully taken from ZenTech servers. Otago Daily Times reporting described delays affecting grieving families whose coronial investigations were caught in the response.
The public record does not establish the initial access method, identify the intruder, confirm ransomware, or state how many people or coronial cases were affected. It also does not explain the route by which court information reached a clinical-research provider. Those unknowns are material and should not be filled with assumptions.
The failure was in the path, not only the endpoint
Security inventories often begin with systems: who owns a database, who operates a server, and who can sign in. This incident points to a second inventory—the journey of each sensitive record. A coronial document can leave its system of record through a referral, attachment, export, research process or subcontracted workflow. If the receiving organization, purpose, retention period and deletion evidence are not visible, the true exposure boundary is unknown.
The operational consequence matters as much as the disclosure. Current cases were delayed even though the court platform itself was not attacked. When records in an external environment must be verified, quarantined or reconstructed, active public services can slow down. Continuity planning therefore has to include the loss of trust in data held outside the primary organization.
Lessons
First, map sensitive information by journey, not only by application. The map should identify every recipient and subprocessor, the purpose for each transfer, allowed fields, retention limits and proof of deletion. Unexplained possession of sensitive records should be treated as a control failure requiring correction.
Second, rehearse clean reconstruction. Agencies responsible for active cases should know how to rebuild the minimum working record from authoritative sources when an external dataset cannot be trusted. The exercise should preserve evidence and privacy while giving staff a safe route to continue time-sensitive work.
Third, separate containment from recovery and from explanation. ZenTech says the incident was contained, but the Ministry is still validating scope and tracing custody. All three workstreams matter. A technically contained intrusion can continue to impose harm until affected people are identified, active cases resume, and the data path is understood well enough to prevent a repeat.
What remains uncertain
The initial access method, attacker identity, ransomware status, total number of affected people and cases, exact court fields, and chain by which Coroners Court information reached ZenTech have not been disclosed. ZenTech’s public notice is undated; September 20 is used as the earliest reliably reported date of that notice, not as the incident date.
Sources & method
AI-assisted research and drafting, reviewed by the editor before publication. Reporting is attributed to the sources below; this is not an independent forensic investigation.
- Statement on ZenTech cyber security incident · Original source · 2026-10-27
- Public Notice · Original source · 2026-09-20
- Health New Zealand statement on Zenith Technology cyber incident · Original source · 2026-09-10
- Grieving families discover coronial investigations caught up in Dunedin health data breach · Reporting · 2026-10-26