Identity theft and data breach notices

Organisations reported 1,093 privacy breaches to the Privacy Commissioner in the 2024/25 year, up from 864 the year before. Many of those led to letters or emails telling people their details had been exposed. This guide helps you work out what a notice like that means for you, and what to do if your identity is being misused.

You’ve received a breach notice

A notice should tell you what happened, what information was involved, what the organisation is doing, and what you can do. Read it for these specifics:

What was exposed? The answer decides your next step.

Ask questions. If the notice is vague, write back and ask exactly which of your details were involved. You’re entitled to ask an organisation for the information it holds about you, and our request letter builder can help.

Be wary of follow-up messages. Scammers send fake breach notices and fake “compensation” offers. Contact the organisation through its own website or app.

If the notice came from a breach that harmed you, you can complain to the organisation’s privacy officer and then to the Privacy Commissioner.

Credit file suppression

A credit file suppression, sometimes called a credit freeze, stops credit reporters releasing your credit information to lenders for a period. Since most lenders check your credit before giving credit, it makes it much harder for someone to borrow in your name.

The three credit reporters in New Zealand are Centrix, Equifax, and the business formerly known as illion, which now operates as Experian in New Zealand. Suppressions are governed by the Credit Reporting Privacy Code and are free.

• One request can cover all three. Centrix and Equifax can pass your request to the other reporters if you agree, so you don’t have to apply three times.
• The first suppression is short. Centrix and Equifax say the initial suppression lasts 20 days. Set a reminder a few days before it ends.
• You can ask to extend it if you believe you are, or are likely to be, a victim of fraud. The reporter will consider the request, and the suppression continues while it does.
• It doesn’t affect existing credit. Your cards and loans keep working. It may delay a new loan application, and you can ask for a temporary release when you genuinely apply for credit.
• You’ll need to prove who you are. That protects you from someone suppressing, or lifting, a suppression on your file.

IDCARE, a free identity support service, keeps an up-to-date guide to suppressions in New Zealand.

Your ID has been stolen or is being misused

Work through these in order of risk:

1. Passport: report it lost or stolen to the Department of Internal Affairs so it’s cancelled.
2. Driver licence: get a replacement through NZTA Waka Kotahi. A new licence has a new card version number, which helps against misuse of the old one.
3. Credit: place a suppression with the credit reporters.
4. Bank: tell your bank and ask it to add extra checks to your accounts.
5. IRD: tell Inland Revenue if your IRD number has been misused.
6. Police: report identity fraud on 105. You may need a Police reference number for banks and lenders.
7. Support: IDCARE (0800 121 068) will help you work out a response plan for your situation, free.

Get a copy of your credit report

You can ask each credit reporter for your own credit report free. Look for enquiries or accounts you don’t recognise. Do this once a year anyway, and straight away if you suspect misuse.

Check what’s already out there

The NCSC’s How Exposed Am I checks your email addresses against known breaches. If one shows up, change the passwords linked to it.