New Zealand transport agency data breach leads to targeted vehicle theft
Take action: This is another example of why timely offboarding and user disabling is critical.
Learn More
The New Zealand Transport Agency (NZTA) is reporting a privacy breach that compromised personal information of nearly 1,000 individuals and directly resulted in at least 13 vehicles being targeted for theft.
The security incident resulted from the misuse of a Motocheck account belonging to an ex-employee of Auckland Auto Collections Ltd, who used their access credentials to illegally obtain names and addresses from the Motor Vehicle Register. The Motocheck system provides registered users with electronic access to vehicle registration information.
The breach occurred over a 12-month period leading up to May 2025, when NZTA became aware of the breach through a customer complaint and police investigation.
In this case, Auckland Auto Collections Ltd, as a registered motor vehicle trader, had legitimate access to the Motocheck system for business purposes, but inadequate controls allowed a former employee to continue accessing the system for unauthorized purposes.
Exposed data includes:
- Full names of vehicle owners
- Home addresses of vehicle owners
The combination of names and addresses proved sufficient for criminals to identify valuable vehicles and plan targeted theft operations.
NZTA determined that the personal information of 951 individuals was accessed improperly during the 12-month breach period, with at least 13 of these vehicles subsequently being suspected of targeted theft.
NZTA has begun contacting potentially affected individuals to advise them of the breach, provide updates on remediation actions, and offer support and advice to address their concerns. NZTA is actively assisting police with their investigations into both the data breach itself and the suspected vehicle thefts that resulted from the compromised information.
