Te Whatu Ora chief executive Margie Apa said the potential release of information breached an order that the Employment Relations Authority had made preventing the publication of the Covid-19 vaccination data.
The threat had been made on X, formerly Twitter.
A post on X by a prominent Covid-19 misinformation spreader overseas shows an email directly to Te Whatu Ora’s chief executive saying, “I just completed an analysis by gender and the results are simply devastating for the Covid-19 vaccine.”
The email continued: “I was wondering if I can share the results with your epidemiologists who can confirm what I found. That way I can avoid disclosing the names.
“Otherwise, in order for people to verify the results themselves, I’ll have to release the names which I would like to avoid doing if at all possible.
“Please let me know which way you would like to proceed: a) have your epidemiologists confirm the analysis so we can keep the names confidential so we can save lives b) have me expose the names so that everyone can verify the analysis is correct so that we can save lives.
“My strong preference is a). But I suspect that you prefer option b). If I don’t hear from you, I will assume you choose b). Thanks!”
The Covid-19 vaccine has been subject to inaccurate claims about its safety which have been debunked by medical experts.
Apa said the vaccination data set previously posted online included anonymised information on dates of when people were vaccinated.
Apa said Te Whatu Ora had taken action after the threat was made, including stopping the employee from accessing its computer systems, getting urgent orders from the Employment Relations Authority to stop the sharing of the information should it be released, and asking different websites and internet platforms to remove any information.
“Our investigation thus far has shown that with considerable effort, we believe someone with expert technical knowledge could potentially identify a very small number of individuals, some of these individuals are deceased,” she said.
“Once our forensic work is complete, we will contact the families of those that could be identified.”
She said their investigation so far had found the employee “inappropriately” sent other information to people outside Te Whatu Ora.
“There is no evidence at this time this information was shared publicly, or with other people, however we are working with experts to provide us with further assurance this information was not shared more widely,” Apa said.
Since Te Whatu Ora became aware of the breach, it disabled the employee’s access to its computer systems and information, notified the Privacy Commissioner and worked with the commission to appropriately respond, and “placed the highest priority on investigative work” including using cross-government skills and international expertise in cyber and data security.
“We wish to thank all organisations who have assisted us in some way, recognising the importance of protecting personal information. This includes government agencies and companies who have responded in a timely way to support our work,” Apa said.
“Alongside our operational response we are looking at our processes for data security and will make any changes that are needed to further increase the security of information.”
He pleaded not guilty yesterday in the Wellington District Court and was greeted with applause by his crowd of supporters in the public gallery, including high-profile conspiracy theorist Liz Gunn.
His lawyer, Matthew Hague, advised the court his client had elected trial by jury. Young is next due to appear in court on February 23.