Coronial files sat with a pharma lab nobody at Justice hired

A ransomware attack on a Dunedin laboratory company has stalled coronial investigations, and the Ministry of Justice can’t yet explain why that company held its records. The ministry has confirmed to Stuff that Coroners Court information was captured in the attack on ZenTech, also known as Zenith Technology, a private firm providing clinical trial and analytical lab services to the pharmaceutical industry and working with Health NZ.

This is not an IT story. It is a story about what happens when an organisation loses track of its data supply chain. Every business that outsources anything should read it that way.

Families are paying for a supplier’s weakness

One Dunedin family has waited 36 weeks for a coronial finding into the unexpected death of their 73-year-old mother. A case manager told them the case was “hindered by a cyber attack experienced in Dunedin” and that files were in “digital quarantine”. The daughter called the situation “incredibly unfair and exhausting”. Another family, nine months into their wait, called it “incredibly stressful”.

The affected material covers some Otago and Southland coronial cases, largely from 2016 to 2022. The ZaWoo group claimed responsibility and posted names, addresses and blood test results on the dark web on 31 August, demanding a bitcoin ransom. Its parting line was pointed: “there is no backup of the customer’s privacy and trust.”

Coronial findings are not paperwork for its own sake. They feed insurance claims, estate settlements and liability decisions. When findings stall, insurers, lawyers, executors and employers stall with them.

No contract, no visibility, no excuse

Ministry chief operating officer Carl Crafar says the incident “didn’t target the Ministry of Justice or court systems directly” and that the ministry has no contract with ZenTech. It is still investigating how ZenTech came to hold the information at all.

That is meant to reassure. It does the opposite. A government department responsible for some of the most sensitive records in the country has found its data sitting with a fourth party it never engaged. Whatever chain connected the two, whether via pathology, toxicology or Health NZ arrangements, nobody at the top of it appears to have mapped where the records went next.

ZenTech did not respond to Stuff’s request for comment. Health NZ said in September its own systems were unaffected and the response was being handled through national incident protocols.

We have been here before

The frustrating part is the repetition. In December 2022, ransomware hit Wellington managed service provider Mercury IT and blocked access to roughly 14,500 coronial files and around 4,000 post-mortem reports. The same breach compromised about 8,500 Middlemore bereavement care records and 5,500 Cardiac and Inherited Disease Registry files, plus data from six health regulatory boards.

The National Cyber Security Centre confirmed at the time that a provider serving multiple agencies had been compromised. Because the affected transport files ran nationwide from 2018 to 2022, the ministry contacted March 15 families directly. In 2022, Crafar said there was no evidence sensitive coronial information had been taken, “but the ministry cannot rule out that possibility.” In 2023 the ministry later confirmed no coronial files were among material released on the dark web.

Back then, Emsisoft threat analyst Brett Callow pointed to the UK’s move towards mandatory reporting and security requirements for MSPs, saying in 2022 it was “something the New Zealand government should be considering too”. Four years on, there is no sign of an equivalent regime here. Centre-right instincts rightly resist piling compliance onto business, but basic standards for firms holding government data are not overreach. They are the price of the contract.

A system with no slack

The coronial system was stretched before either breach. The ministry’s 2022-23 annual report recorded more than 6,000 active coronial cases, and Budget 2022 had already put $28.5 million in operating funding toward speeding things up. A system with that backlog cannot absorb a supplier outage. Every quarantined file joins a queue that was already too long.

What business owners should take from this

The lesson travels well beyond Wellington. If your customer data passes to an accountant, a payroll platform, a lab or a cloud vendor, ask where it goes after that. Sub-processors are where visibility dies and liability survives. Contracts should name who can hold your data, require notification of onward sharing, and set minimum security standards. Then check they are being met.

The ministry now has two breaches in four years traced to companies outside its own walls. The next question is not whether its systems are secure, but whether it knows where its records actually live. Until it can answer that, families will keep waiting, and every other organisation relying on its findings will wait with them.

Sources

• Stuff: Grieving families’ ‘incredibly stressful’ wait for answers after major NZ cyber attack (2026-10-27)
• NZ Herald: 14,000 coronial files blocked – Ministry of Justice confirms cyber attack (2022-12-06)
• RNZ: Investigation underway into cyber attack which hit thousands of coronial and health files (2022-12-06)
• Newsroom: March 15 families contacted over cyber attack (2022-12-15)
• Ministry of Justice: Statement – Cyber security incident (2023-03-09)
• NZ Herald: Ransomware attacks – Are stolen Justice, health, insurance files appearing on the dark web? (2022-12-07)
• Ministry of Justice: Annual Report 2022-2023 (2023)