Mediaworks has this morning told affected Kiwis it understands the attacker has published the stolen data online after a hack.
Initially, it was feared millions of Kiwis could have been affected – but Mediaworks now says it was a significantly lower figure.
The hacker claims to have stolen people's names, addresses, mobile numbers, email addresses, date of birth, home phone numbers, user IDs and other private information. They said they planned to sell the information.
MediaWorks has confirmed a database containing information from individuals who entered its online competitions has been breached.
In an email this morning to people who have entered its competitions since 2016, chief executive Wendy Palmer said: "The types of information held in this database and accessed by the attacker include name, date of birth, gender, postal address and/or post code, email address, phone number, and in some cases images or videos that may have been submitted as part of the entry.
"Importantly, the affected database did not contain passwords, identity documents, financial information, bank accounts or credit card details. We understand the attacker has published the information online," Mediaworks added.
Those affected were urged to be vigilant and refer to available online safety guidance.
And the company had advice for any Kiwis who are contacted by the hackers.
One of the victims of the data leak has said they were contacted and asked for a ransom of US$500 (NZ$820) in cryptocurrency.
"We are aware that some individuals have been contacted by the attacker requesting payment for deletion of their information," today's statement from Mediaworks said.
"If this happens to you, we strongly recommend that you do not pay as there is no guarantee your data will be deleted even if you do pay."
The breach
Mediaworks also outlined exactly what happened and the steps it has taken since.
"On Friday 15 March we became aware of claims of a cyber-attack on our systems. The affected database was identified and taken offline on Saturday 16 March, and all current competition entries were moved to a new database," the email read.
An incident response team was "promptly" appointed.
"From initial investigations, we understand the attacker was able to access the data of approximately 403,000 individuals by exploiting a previously unidentified system vulnerability.
"MediaWorks, with the support of external experts, is currently reviewing all other IT systems and cyber security protections to identify and mitigate any other possible security vulnerabilities."
Alongside other measures, the company has contacted the police.
"In line with New Zealand Government guidance, we have not engaged with the attacker."
Anyone with immediate questions or concerns was urged to contact the company's privacy officer at privacy@mediaworks.co.nz.
"We sincerely apologise for any concern and inconvenience that this incident may cause you.
"We want you to know that MediaWorks takes data security seriously and is working hard to make sure this doesn't happen again."
MediaWorks both owned and operated Three television before Discovery took ownership of the channel in 2020. It also previously owned and operated Today FM before the news station's shock closure last year.
The company currently runs a range of radio stations which include The Edge, George FM, More FM, Mai FM, The Rock, The Breeze, Rova and Magic.
SHARE ME