Several government agencies and other facilities have access to that information and Hipkins said: "as yet we don't know for certain where in the process the information has ended up being released".
Hipkins, who is also three days into the job as Health Minister after David Clark resigned, has asked the State Services Commission to work with the various departments.
"Work is already underway to assess what the record-keeping practices are, who has access to the information, and how it came into the public domain," Hipkins said.
"It will be thorough and rigorous, and specialist expertise will be brought in if needed. Criminal charges are on the table depending on what we learn.
"We do not yet know the motive but any deliberate leak of this kind is intolerable. Particularly so if it is a malicious act.
"On behalf of the whole government, I apologise to those people involved. We are determined to fix it."
One Herald journalist has seen the spreadsheet. The information has been kept secure and the publication will not contact the people included in the leak.
An 'unconscionable' breach
National health spokesman Michael Woodhouse said the leak of personal details was "unacceptable".
"This is unconscionable and unacceptable that those suffering from the incredibly dangerous virus now have to suffer further with their private details being leaked.
"The Government needs to get to the bottom of this, and quickly.
Woodhouse said New Zealanders had the expectation their information should be kept safe and "it's not difficult to do".
"I think that an unconscionable breach that Chris Hipkins needs to get to the bottom of with all haste."
Woodhouse said the Government not ruling out a criminal investigation into the leak was an attempt to deflect attention away "from the fact it should never have happened in the first place".
"I don't know where it came from or how it got leaked - but to issue threats of criminal prosecution is a distraction to the central point that this should never have happened in the first place if they'd been on top of the management of information."
National leader Todd Muller told RNZ the breach was "quite staggering" and "unacceptable".
"Is it a deliberate leak or is it accidental? It doesn't really matter at a level ... it's loose, it's shabby and it's a reminder these guys can't manage important things well," he said.
