A data breach has exposed the personal details of thousands of gun owners and led to police closing its firearm buyback platform.
The details of more than 37,000 firearm owners, including the guns they possess and bank account information, may have been made publicly available, according to the Council of Licensed Firearms Owners (Colfo).
The gun lobby group said it had received the data from a supporter and has released some images obtained in the breach, with personal details redacted.
Police confirmed the "potential privacy breach" on Monday afternoon, after a firearms dealer raised the alarm.
Prime Minister Jacinda Ardern and Police Minister Stuart Nash both fronted the issue at a weekly post-Cabinet meeting press conference on Monday afternoon.
Ardern said the breach appears to have occurred when a gun dealer, granted access to some information for participating in the buyback scheme, was able to access a fuller database.
The breach did not demonstrate the buyback scheme had failed or needed to be re-evaluated
"The issue here seems to be whether or not they were, by the contracted provider who was overseeing this database, given too much access or not.
"This is not about a website... being open to the general public. Dealers were given access deliberately ... on a confined basis."
Nash said the data was not publicly accessible, and it was not hacked.
- Treasury data breach inquiry shut down over integrity issues
- No evidence patients' data has been stolen, health body says
- Treasury data breach inquiry shut down over integrity issues
- 10,000 gun licence holders have convictions for violence or sexual offending
"This is information that was accessed by someone that who we believe, was perhaps erroneously, given access to the information —so let's be clear on cybersecurity."
Nash said he made clear to police the source of the breach must be identified quickly.
"Police will hold people to account if information has been assessed and shared unlawfully."
The breach did not demonstrate the buyback scheme had failed or needed to be re-evaluated, he said.
Firearm owners who have had semi-automatic firearms and other guns banned following the March 15 terror attack have been asked to notify police of their weapons through an online form.
A police statement issued on Monday afternoon did not detail the extent of the data made publicly available, but said the notification platform - where owners of now-banned semi-automatic firearms provide details of their guns - had been shut down in response.
The issue was described as a "service disruption" on the police firearms website.
Privacy Commissioner had been advised, the police statement read.
Deputy Commissioner Mike Clement, responsible for police's arms control office, would hold a press conference on Monday afternoon.
Did you spot the privacy breach? Email This email address is being protected from spambots. You need JavaScript enabled to view it.
Colfo, in a statement, said several of the group's supporters had taken screenshots and downloaded information of 70,000 licensed firearm owners, their firearms, and bank account numbers.
Colfo secretary Nicole McKee said the number had since been revised to 37,125 licensed owners and the details of 280,000 prohibited firearms and parts.
A firearm owners had notified the gun lobby group of the breach on Monday morning, after attempting to update their own information on the site and discovering a list containing the information.
Another person had downloaded the data, and provided it to Colfo, she said.
How long this information was publicly available was unknown, but its availability meant firearm owners had become "potential targets for criminals", McKee said.
She said Colfo would release the some of the data to prove the gun buyback had failed.
"We will not be releasing any personal details, but we do need to be able to show that this event actually did happen," she said.
"This is a failure, this is the ultimate failure of the system of not only registration, but of the [buyback] system that's been run. We have been asking for it to be slowed down."
The Government has promised to bring in a firearm register for all guns, to be managed by police.
National Party police spokesman Brett Hudson said Nash needed to take responsibility for the breach.
"His Government put the buy-back scheme together. It has failed to protect New Zealanders' private and very sensitive information.
"How can New Zealanders have confidence in the firearms register the Government is proposing when they can't even protect their personal details in their buy-back scheme?"
ACT leader David Seymour said the police minister "must resign" over the data breach and the Government should back down from a planned registry of all firearms.