The Commerce Commission is working with Police and taking a range of other actions following the theft of computer equipment belonging to an external provider.
The Commission was informed last week that more than 200 meeting and interview transcripts across a range of the Commission’s work were contained on computer equipment stolen in a burglary. The transcripts may date back to early 2016 and contain some confidential information businesses and individuals have provided the Commission.
The Commission’s own network and systems have not been breached. The information potentially contained on the stolen computer equipment does not include any documents or general consumer complaints provided to the Commission.
Chief Executive Adrienne Meikle says the Commission has been in close contact with Police and is confident that every possible action is being taken to locate and recover the stolen equipment.
“We are in the process of contacting those affected to discuss the details of the information potentially compromised. Some of the information is subject to a confidentiality order issued by the Commission under section 100 of the Commerce Act. This makes it a criminal offence for any person in possession of the devices or information from the devices to disclose or communicate it to anyone while the orders are in force. We are also exploring other potential legal avenues to help protect the confidentiality of the information,” Ms Meikle said.
“We will also no longer be using the external provider. It was subject to contractual and confidentiality obligations to ensure that information was stored securely and deleted after use. The provider has informed us it did not meet these obligations.
“While this breach has resulted from criminal activity and our provider failing to meet the obligations we placed on it, it is our job to keep sensitive information safe and we apologise unreservedly to those affected. We acknowledge the distress this incident may cause businesses and individuals who have provided information to us in confidence.”
Commission Chair Anna Rawlings said two separate independent reviews have been initiated in response to the security incident. In addition, the Commission will be contacting its third-party suppliers to seek assurances that they are meeting its expectations in relation to information handling and have systems and processes in place to protect its information.
“Information security is crucial to our role and it is vital that those who interact with us can be confident in our ability to protect confidential and commercially sensitive information. We have engaged Richard Fowler QC to undertake an independent review of the circumstances that led to this specific incident.
“Separately, we have also engaged KPMG to review our information handling processes, including third-party supplier engagements. These reviews will report directly to me and the Commission Board. We will make the findings public once we have considered them and any recommendations made.”
