An Auckland ransomware case and three years of Spark disclosures reveal how little the headline numbers can tell customers about their own exposure.
In December 2024, Compass Communications detected unauthorised access to its systems. The Auckland telecommunications provider brought in outside security specialists and notified New Zealand’s Privacy Commissioner. The ransomware group RA World claimed it had stolen 250 gigabytes of data.
The attackers also posted a 26.9 MB sample. Cyber Daily reported that it contained service agreements, financial statements and customer banking details. Compass confirmed the intrusion and said its initial investigation suggested some customer information may have been accessed. It said it would contact customers directly where it identified an impact. The company’s statement gave no customer count or verified figure for the volume of data taken.
The banking details in the reported sample gave customers a more concrete reason to pay attention than the 250 GB claim. An archive can contain several documents for a single account, duplicates of the same file and records unrelated to customers. Its size gives little indication of how many people are affected or whether the records belong to current or former customers.
Three Years of Breach Reports at Spark
Spark New Zealand’s annual reports provide a different view. In FY24, staff reported 228 data breaches for investigation. Of those, 30, or about 13%, met the threshold for notifying affected people and the Privacy Commissioner. Spark said most of those cases involved fraudsters using personal information they had obtained elsewhere, including through phishing or compromised online accounts.
Staff reported 156 breaches for investigation in FY25 and 167 in FY26. The privacy sections of those two annual reports gave no count of how many cases met the notification threshold. Both totals cover the company as a whole, with no separate figures for home broadband customers. Internal reports rose between the two years, but the disclosures leave it unclear whether serious breaches rose as well.
Spark had previously disclosed a specific example. In FY21, it notified customers and the Privacy Commissioner about unauthorised access to some MySpark and Xtra Mail accounts. Spark said customers had reused their login details on other platforms, where the credentials were harvested after those platforms were compromised. At Compass, the company detected unauthorised access inside its own systems. The two cases raise different questions about what an intruder could see, change or copy.
The Gap Between a Breach Count and a Customer Notice
New Zealand’s Office of the Privacy Commissioner recorded 1,093 privacy breach notifications in 2024/25, up 27% from the previous year. Of those, 591 were classified as serious, up 43%. Those figures cover all sectors. The regulator also reported that 71% of serious breaches were notified to its office within 72 hours, compared with 60% the previous year.
Under New Zealand’s Privacy Act, organisations must notify the Commissioner as soon as practicable when a breach has caused or is likely to cause serious harm. The Commissioner expects notification within 72 hours of an organisation becoming aware that a breach is notifiable. Organisations generally must also notify affected people, subject to exceptions. A customer may receive details directly that never appear in a company’s annual report or public statement.
“An old broadband bill can tell a scammer who your provider is, where you live and what you usually pay. That’s enough to make a fake overdue bill look real. When a provider says ‘customer information’ was exposed, people need to know whether that means an email address or a copy of their bill,” says Tomas Novosad, founder of Fibre Broadband NZ.
In the Compass case, a claimed file size made headlines while the number of affected customers was still unclear. Spark’s annual reports offer company-wide totals, with less detail in the two latest years about how many cases reached the notification threshold. For customers, three details would put those numbers in perspective: the types of data involved, the period the records cover and the number of affected accounts.
(Photo by Denny Müller on Unsplash)
——————————————————–
Click Here For The Original Source.
