Hackers demand ransom from New Zealanders whose data was allegedly stolen in a data breach at local media firm

MediaWorks, a leading New Zealand radio, outdoor advertising, and interactive media company, is investigating a data breach that may have exposed the personal information of over 2.5 million people.

Although the company has yet to confirm the incident, hackers are actively trying to exploit the allegedly stolen data by directly contacting victims with demands to make payments.

“On Friday evening (15 March), we became aware of claims that MediaWorks had been subject to a cyber security incident,” the company said. “The claims relate to data from website competition entries. Last night, all current competition entries were moved to a new secure database.”

According to news outlet The Record, a hacker has recently announced his intent to sell exfiltrated data on a hacking forum, which includes names, addresses, dates of birth, and phone and email contact details of various individuals.

One person, who wished to remain anonymous, even reached out to Radio New Zealand after he received an email from the alleged hackers on March 14.

The message that arrived in his inbox under the subject line “Attention! Your data has been leaked!” offered the recipient the chance to remove his data for $500 USD in Bitcoin (BTC).

Here’s a snippet of the message, courtesy of RNZ:

"We are writing to inform you of a concerning data breach at MediaWorks New Zealand that has compromised the personal information of 2.5 million New Zealand citizens, including yours. We attempted to negotiate with MediaWorks by offering a very low price to have them secure the data, but unfortunately, they displayed a disappointing lack of concern and refused. Their dismissive attitude, treating the data as valueless, has led us to consider releasing it publicly," it said.

"Therefore, we are contacting you because your information is part of the leaked data. To protect yourself from potential harm, we are offering a one-time opportunity to have your data removed for a fee of $500 USD in Bitcoin (BTC). This fee helps us cover the costs associated with recovering and deleting your data."

MediaWorks says it is investigating these claims and urges users to submit their concerns via [email protected]

How can you take proactive measures and reduce the impact of data breaches?

Use Bitdefender Digital Identity Protection to control, manage and safeguard your identity against data breaches and leaks. Our identity protection service continuously scans millions of websites and the Dark Web, searching for your leaked data. You can visualize your digital footprint at a glance, check your breach history, map risk, and any personal information that may have ended up online: email addresses, phone numbers, passwords, social media links, physical addresses, and credit card details.

On top of 24/7 data breach alerts, you can benefit from the industry's first Identity Protection Score to help you understand the extent of the breach and how it can impact you and receive actionable advice to immediately minimize risk and safeguard your well-being.