There has been a massive privacy breach, with the leak of personal details revealing the identity of New Zealand's 18 active Covid cases.
RNZ has seen a document that includes the full names, addresses, age and the names of the hotel and one hospital the 18 have been quarantining in.
The State Services Commission has been called in to make sure a "thorough investigation" is held.
State Services Minister Chris Hipkins said the fact this personal information had been given out was totally unacceptable, and he has ordered an investigation.
"I have been advised by the Ministry of Health that at this stage it cannot be confirmed beyond doubt whether a deliberate leak was involved or if this was simply human error.
"If it was the former, it is unconscionable and absolutely beggars belief why anyone would feel it was an acceptable action to take, given the trauma it is likely to cause those whose information is involved. It would, quite frankly, be abhorrent, and potentially criminal.
"Either way", he said, "it cannot happen again.
"The public has every right to expect their private information to be held securely."
The personal information relates to 18 people who have tested positive for Covid-19 and who are quarantining in both the North and South Islands.