IntraCare Confirms Data Exfiltration; High Court Injunction Made Permanent
Summary
IntraCare says an investigation confirmed data was exfiltrated after unauthorized access in March 2026, and some was made available on the dark web. A group is suspected; a New Zealand High Court injunction has now been made permanent.
Key points
- IntraCare says unauthorized network access was detected on March 20, 2026, and its investigation later confirmed that some data was accessed and exfiltrated.
- The company says some data was made available on the dark web and that an unnamed group is suspected of responsibility.
- IntraCare shut down IT systems as a precaution and deferred patient procedures for the week starting March 23; services resumed on March 30.
- Cybersecurity firm CyberCX assisted with a forensic investigation, and IntraCare notified government agencies, police, and the Office of the Privacy Commissioner.
- IntraCare says no new data has been accessed since March 20 and that monitoring found no new developments as of its October 29 update.
- A New Zealand High Court injunction that initially restrained access to or handling of the information has been made permanent.
- IntraCare advises patients to verify unexpected requests for money or personal information and says IDCARE support remains available.
Article Details
- Victim Organization
- IntraCare
- Victim Domain
- intracare.co.nz
- Incident Type
- Unauthorized access to IntraCare’s network, followed by confirmed data exfiltration and availability of some data on the dark web.
- Incident Date
- 2026-03-20
- Disclosure Date
- 2026-03-26
- Data Types Exposed
- Patient data; specific data types were not disclosed
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- IntraCare shut down its IT systems as a precaution and deferred patient procedures during the week beginning 2026-03-23. Services resumed on 2026-03-30; IntraCare said the quality and safety of medical care remained unaffected.
- Ransom Or Extortion
- No ransom demand or extortion payment was reported. IntraCare confirmed that some data was exfiltrated and made available on the dark web by a group it suspects was involved.
- Claim Status
- confirmed