The Earthquake Commission has been ordered by the Government to shut down all its outgoing IT systems after another email was sent leaking private information.
It is the second privacy breach revelation in less than a week for the organisation, after it admitted on Friday to unintentionally releasing the details of all 80,000 claimants in its Canterbury Home Repair Programme - an incident it described as "embarrassing".
Today it was revealed in Parliament that a second email was also sent containing the personal details of claimants, including names and bank account details.
The email contained a spreadsheet with 2200 names, information about those people, including money owed in stopped cheques, totalling around $23 million.
Earthquake Minister Gerry Brownlee has now ordered the commission to shut down a number its computer systems, including its external email service and business-to-business exchanges.
He has also told the Government's chief information officer, Colin MacDonald, to investigate what happened.
Brownlee said he was "deeply distressed and concerned" by the leak, which he said may be attributed to an IT problem.
"The recipient took the appropriate actions and advised EQC they
had received the information in error through EQC's online
complaints process about a month ago," he said.
"It would appear that email was either not seen by EQC or not acted upon.
"This is a completely unacceptable situation, but may be as a result of IT system problems."
What action has been taken?
Brownlee has ordered EQC to immediately shut-down all external
email systems, so that no emails can be sent or received by the
organisation. All business-to-business systems and data exchanges,
as well as access into EQC systems by external parties, has also
been immediately shut-down.
MacDonald will be tasked with investigating the problem and overseeing the implementation of a solution.
"Mr MacDonald will develop a priority work programme to resolve and manage the issues with EQC's information systems and bring its processes and procedures up to standard," said Brownlee.
"I have asked for this investigation to be completed as quickly as possible to enable a resumption of claims processing and apologise for the delay this will cause.
"We hope some systems may come back into operation progressively in the days ahead, depending on the depth and extent of the issues found.
"I think this is a timely opportunity to draw breath after what has been a very rapid growth for EQC and ensure the privacy New Zealanders have the right to expect from any agency holding private information is offered to them by EQC."
Privacy breach 'staggering'
Earlier today Labour MP Lianne Dalziel revealed the breach during Parliamentary Question Time. She described the scale of the privacy breaches by EQC as "staggering".
"This is an absolute scandal and proof that there is a systemic problem with the security of electronic data held by EQC and other agencies across the entire state sector," she said after Question Time.
"New Zealanders take their privacy very seriously. But this Government has let them down time and time again. We've now had major breaches at EQC, ACC, MSD, IRD, Corrections and Novopay.
"What will it take for this Government to act? It's time to stop the flippant responses such as Gerry Brownlee dismissing it as 'similar to putting the wrong address on an envelope' and give New Zealanders the confidence they deserve that their information is safe."
However, when she raised the topic in Parliament, Brownlee hit back at her saying she should have informed him of the allegations as soon as she received them.
"If the member considers this the breach that it appears to be I'm disappointed she didn't contact my office to let me know that she is now in receipt of people's private information," he said in response to her questions.
He added that she had time to contact him before the afternoon session began.
"I will certainly check it out, and take whatever action is necessary to ensure that EQC does get on top of its system, so this sort of thing doesn't happen," he said.
The exchange prompted much shouting and jeers in the House, with some calling on Brownlee to resign over the leaks, and the Speaker having to call for order.
ONE News contacted EQC, but it said it would not comment on this latest privacy breach allegation.