A Te Whatu Ora employee is accused of leaking data from the health ministry’s National Vaccination Database to spread misinformation about vaccines.

Websites in the United States and New Zealand have picked up the data and claimed the Covid-19 vaccination caused large numbers of deaths.

But just four deaths in this country have been linked to the Covid-19 vaccine. So what’s going on? What information has been leaked? And what happens next?

What’s happened?

A staff member working in a unit that maintains and builds databases for Te Whatu Ora is alleged to have downloaded a large amount of vaccine-related information and shared that information.

That staff member is Barry Young – who also goes by the name Winston Smith. He has appeared in videos with anti-vaccination campaigner Liz Gunn where the two speak about the data.

A number of people in the United States have also shared what they claim is analysis of the leaked data.

Since the initial release on November 30, Te Whatu Ora has filed a police complaint and Young was arrested on Sunday. He’s since appeared in court, charged with dishonestly accessing a computer, where he entered no plea.

What data has been released, and should I be worried?

The data allegedly taken was “vaccine related information”, according to the health authority’s chief executive, Margie Apa.

Apa said early analysis had found the data was anonymised and, so far, no National Health Index Numbers or personally identifiable information had been found in the leak.

How did this happen?

Apa told RNZ on Monday that Young had worked in health for about five years and had been working as part of a small, specialised team.

She said Young had access to some data sets to help him do his job and others in his small team had similar access.

Apa said on Thursday morning, a number of people at the health authority received an email from an employee that said the data had been leaked.

The health authority’s investigation had not found anyone else working with the alleged leaker, Apa said.

So what’s being done?

Other than the police charges against Young, Te Whatu Ora has taken out an injunction which they have already used to have the information taken down from an overseas website.

Apa said cybersecurity specialists were scanning “extensively” for any other places where the information might appear, although Stuff found a site where the data was being quoted.

The non-publication order was issued on December 1 to “restrict all access, use and publication of information held by Te Whatu Ora on the National Vaccination Database, or any copies, extracts or information derived from it”.

Anyone in possession of the data must not disclose or release any of the information or any extracts, and must delete any copies of the information that they have in their possession.

Apa also told RNZ on Monday that security protocols were being updated and security codes were being reset.

Why is it a big deal?

It’s an issue on two fronts. The first is the data breach of sensitive information from a government agency that was allegedly taken and then shared.

While no identifiable information has yet been found amongst the leaked data, Te Whatu Ora has not ruled it out entirely.

The second aspect is what the information is being used for, which is spreading misinformation about the Covid-19 vaccine.

How so?

Some of those with their hands on the data are claiming the Covid-19 vaccine caused thousands of deaths in New Zealand.

Te Whatu Ora has rejected that claim, with Apa saying it was “completely wrong and ill-informed”.

”The person has no clinical background or expert vaccine knowledge and appears to be trying to spread misinformation,” she said in a statement.

Apa said publicly available data showed four deaths in New Zealand were possibly linked to the Covid-19 vaccination, as opposed to the 3,361 deaths directly attributed to Covid-19.

Should the claim that thousands of people died from the vaccine be correct, then those numbers would show up in the publicly available statistics of deaths above those expected from natural causes, said University of Canterbury mathematics professor and Covid-19 modeller Michael Plank.

But he said statistics showed the overall death rate post-pandemic was lower than most years prior to it.

He said the timing of the deaths that are being quoted in the data leak, coincided with the spread of Covid-19 through the country, rather than when the vaccination rollout was at its peak.

A peer-reviewed study published in the New Zealand Medical Journal this year found if NZ had followed trends of excess deaths (the amount of deaths above the expected annual number) of either the UK or US then there should have been between 16,000 and 19,000 excess deaths in Aotearoa during the pandemic.

But that number has hung around zero for most of the time, with it climbing to 122 at the time the article was published in October.

NZ has a higher vaccination rate than both the United States and the United Kingdom.

Professor Michael Baker, who helped author that report, said that while there were some cases of death related to the vaccine, they had to be weighed against the thousands who were saved.

Some also claimed that deaths following vaccination spiked, but Baker said the opposite was actually true, with death rates dropping – though not necessarily because of the vaccine.

Along with that, New Zealand has a number of bodies which monitor and review the vaccine rollout, such as the Centre for Adverse Reactions Monitoring (CARM).

Data of natural death rates and observed death rates following vaccination have also been checked by health regulator Medsafe and the Independent Safety Monitoring Board (ISMB).

“It’s incredibly damaging,” said Plank of the claims being made of the data leak.

“It’s the classic line that the lie is halfway around the world before the truth has its boots on.”