RA World claims 250 GB theft from NZ telco Compass, Hackread reports

What happened

According to Hackread, Auckland telecommunications provider Compass Communications detected unauthorised access to its systems in December 2024. Hackread says the company brought in outside security specialists and notified New Zealand’s Privacy Commissioner. The ransomware group RA World claims it stole 250 gigabytes of data. This is a claim by the group, and Hackread does not say it has been independently verified.

Hackread says the attackers also posted a 26.9 MB sample. It says Cyber Daily reported that the sample contained service agreements, financial statements and customer banking details. According to Hackread, Compass confirmed the intrusion and said its initial investigation suggested some customer information may have been accessed. Compass said it would contact customers directly where it identified an impact. Hackread says the company’s statement gave no customer count and no verified figure for the volume of data taken.

Hackread also reviews Spark New Zealand’s annual reports as context, not as a new incident. It says Spark staff reported 228 data breaches for investigation in FY24, and 30 of them (about 13%) met the threshold for notifying affected people and the Privacy Commissioner. It gives 156 reports for FY25 and 167 for FY26, with no count of notifiable cases in the privacy sections of those two reports.

Hackread says the Office of the Privacy Commissioner recorded 1,093 privacy breach notifications in 2024/25, up 27% on the previous year, across all sectors.

Not confirmed in the source: how many customers are affected, whether the records belong to current or former customers, how the attackers got in, and whether the claimed 250 GB figure is accurate.

Am I affected?

Only Compass Communications is named in the source as the subject of the RA World claim. Hackread says Compass has said it will contact customers directly where it identifies an impact. Whether you are affected is not confirmed publicly. The Spark figures in the article are company-wide statistics and do not describe a new Spark incident.

What to do now

1. If you are or were a Compass customer, watch for a direct notice from Compass. Hackread says the company will contact customers where it identifies an impact.
2. When you receive a notice, ask which types of data were involved, which period the records cover and how many accounts are affected. Hackread names these three details as the ones that would put the numbers in perspective for customers.
3. Be cautious with unexpected overdue-bill messages. Tomas Novosad of Fibre Broadband NZ is quoted by Hackread as saying an old broadband bill can tell a scammer who your provider is, where you live and what you usually pay, which can make a fake overdue bill look real.
4. Check the Compass statement and Hackread for updates. Nothing beyond what is summarised above is confirmed.

Sources

• Hackread: Inside New Zealand’s Telco Data Breaches