Te Whatu Ora, New Zealand’s public health agency, got wind of the breach through an email sent by the individual in question.