MediaWorks Breach Exposes 162,710 Personal Records from Online Competition
What Happened — In March 2024, a dataset containing 162,710 unique records from New Zealand media company MediaWorks was posted on a public hacking forum. The data set includes email addresses, dates of birth, physical addresses, phone numbers, genders and the answers participants gave to an online competition questionnaire. Some of the exposed individuals later received ransom‑demand messages promising data deletion for payment.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic failure to enforce data‑handling controls and to maintain continuous evidence that personal information is protected.
- A control‑assurance program would require documented privacy‑by‑design processes, regular verification of data‑collection forms, and auditable logs showing who accessed or exported the data.
- Leveraging Verisq’s CookiePLUS privacy capability provides a reusable consent and data‑subject‑request framework that can generate the evidentiary artifacts needed for audit readiness.
Who Is Affected – Media and entertainment organisations that run public‑facing campaigns; New Zealand residents whose personal details were collected via the competition.
Recommended Actions
- Conduct an immediate privacy‑impact assessment of all online contest and lead‑generation forms.
- Verify that consent records, data‑retention policies and access logs are complete and can be exported for audit purposes.
- Deploy a consent‑management solution (e.g., CookiePLUS) to capture, store and demonstrate lawful processing of personal data.
Technical Notes – The breach appears to stem from a misconfiguration or inadequate protection of the competition data store, allowing the entire dataset to be scraped and posted. No specific vulnerability (CVE) was disclosed. Source: https://haveibeenpwned.com/api/v3/breach/MediaWorks