Short answer
On 27 October 2026 New Zealand's Ministry of Justice said some Coroners Court information was caught up in a cyber incident at Dunedin company Zenith Technology (ZenTech). The attack was claimed by a ransomware group, a High Court injunction bars anyone from using or publishing the data, and a small number of coronial cases have been delayed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Zenith Technology (ZenTech) |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by the organization |
| Sector | Clinical trials and laboratory services |
| Country | New Zealand |
| Disclosed | 2026-09-10 |
| People or records affected | Not disclosed. ZenTech says a limited number of people; the Ministry of Justice has not yet confirmed which coronial cases are involved. |
What data was exposed
- Coroners Court information, mainly Otago and Southland cases from 2016 to 2022
- Health-related and identifying information from clinical trials (per ZenTech)
- Material ZaWoo posted online purported to show names, addresses and blood test results (per Stuff, via Insurance Business NZ; not confirmed by ZenTech)
What happened
Zenith Technology, known as ZenTech, is a private company in Dunedin. It runs clinical trials and laboratory work for drug makers and has worked with Health NZ. On 10 September 2026 1News reported that Health NZ had found files attributed to ZenTech online. ZenTech confirmed a cyber incident and said sample material purported to be company data had been published.
The story widened on 26 and 27 October. The Ministry of Justice said some Coroners Court information was part of the incident. The Otago Daily Times reported that a Dunedin family had learned why their relative’s coronial case had stalled.
Timeline
- Around August 2026: the attack takes place, according to Insurance Business NZ.
- 31 August: the ZaWoo group posts material on the dark web that purports to show patient data, per the same report, which cites Stuff. ZenTech has not confirmed what that material contains.
- 10 September: Health NZ and ZenTech acknowledge the incident. Police begin an investigation.
- 25 September: the High Court sets terms for an interim injunction over the data, according to The Lawyer Magazine.
- 27 October: the Ministry of Justice publishes its statement.
What the Ministry and ZenTech say
The Ministry says the affected material is mainly Otago and Southland coronial information from 2016 to 2022. It says further checks are needed to know which cases are involved and how the information reached ZenTech. A small number of current cases have been delayed. It will not comment further because of the police investigation.
ZenTech told reporters that a limited number of people were affected and that it was working with outside cyber experts. Health NZ says its own systems were not affected. Ministry chief operating officer Carl Crafar said government systems were not targeted.
One Dunedin family, as reported by the Otago Daily Times, had waited about nine months for findings on an elderly relative’s death. They were told progress was hindered by the attack.
What is still unknown
Nobody has published a count of affected people. It is not clear how coronial records ended up with a clinical trial company. The National Cyber Security Centre has not confirmed whether it is involved, according to Insurance Business NZ. The Ministry says it is working with police and Health NZ to identify the affected cases.
Scam risks for families
Grieving families are an easy target. A caller who knows a relative’s name and a court date can sound official. Read our guides on government impersonation scams and phishing messages, and the steps in what to do after a data breach.
See other incidents on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Callers or emails claiming to be from the Coroners Court, Health NZ or ZenTech asking for fees, payment or personal details
- Fake 'data protection' or compensation offers that ask for bank details
- Messages that quote a real medical detail or a relative's death to sound credible
- Fake fines or court payment links by text, which the Ministry says it does not send
What to do if you are affected
- 01If you fear a relative's coronial case is involved, call the Ministry of Justice families line on 0800 638 924 (weekdays, 8am to 5pm).
- 02If you took part in a ZenTech clinical trial, contact ZenTech or the study team for details, and ask what data of yours was held.
- 03Do not pay or click links in unexpected texts or emails about courts or fines. The Ministry says it does not send payment links. Call 0800 COURTS (0800 268 787) to check.
- 04Report scam attempts to Netsafe and cyber incidents to the National Cyber Security Centre. Raise privacy concerns with the Office of the Privacy Commissioner.
- 05Do not share or look for the leaked files. A High Court interim injunction prohibits accessing, using or publishing them.
- 06If someone uses your details for fraud, contact IDCARE, which supports people in New Zealand and Australia.
Frequently asked questions
What is ZenTech?
Zenith Technology (ZenTech) is a Dunedin contract research company that provides clinical trial and analytical laboratory services to the pharmaceutical industry, according to 1News.
Is my relative's coroner case affected?
The Ministry of Justice says the information relates mainly to Otago and Southland cases from 2016 to 2022, but it has not yet confirmed which cases. Families can call 0800 638 924.
Was the Ministry of Justice hacked?
No. The Ministry says the incident did not target its systems or court systems. It is still working out how the information came to be held by ZenTech.
Who attacked ZenTech?
A group calling itself ZaWoo claimed the attack, according to Insurance Business NZ. It reported that the group published data on a dark web site on 31 August 2026 and demanded a bitcoin ransom.
Can I read the leaked files?
You should not. A High Court interim injunction prohibits anyone from accessing, using or publishing the confidential information.
Sources
- Statement on ZenTech cyber security incident, New Zealand Ministry of Justice, 2026-10-27
- Grieving families discover coronial investigations caught up in Dunedin health data breach, Otago Daily Times, 2026-10-27
- Third-party cyber risk exposed by ZenTech ransomware breach, Insurance Business NZ, 2026-10-28
- Coroners Court information affected by ZenTech cyber incident, The Lawyer Magazine NZ
- Health Minister briefed amid fears clinical trial files stolen, 1News, 2026-09-10
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.