Communication to shareholders

`
Mercury NZ Limited
Level 3, 109 Carlton Gore
Road, Newmarket 1023

PHONE:
+ 64 9 308 8200
mercury.co.nz
PO Box 90399, Auckland 1142 New Zealand
FAX:
+ 64 9 308 8209



29 May 2018 – Attached is a copy of correspondence to be sent today by email or letter to shareholders on our
share register as at 7 November 2017 relating to a disclosure of information which took place on 10 November
2017.



Howard Thomas
Company Secretary

END

Attachment:
Sample email / letter communication to shareholders
STOCK EXCHANGE LISTINGS: NZX (MCY) / ASX (MCY)

COMMUNICATION TO SHAREHOLDERS

---

Mercury NZ Limited
PHONE:
+ 64 9 308 8200
mercury.co.nz
Level 3, 109 Carlton Gore Road, Newmarket 1023 New Zealand
FAX:
+ 64 9 308 8209

















Dear Shareholder

We have made a mistake and we want to let you know about it.

What’s happened?
We recently became aware that shareholder information loaded by Mercury to the New Zealand Companies
Office website contained information not commonly available.

We took immediate action when we found out. The information concerned is no longer publicly accessible.
We are not aware of any misuse of the information. However, we think it’s important that you know what has
happened and what we have done about it.

What extra information was made available?
For context, every shareholder’s name, address and shareholding is publicly available through our share
registrar on request.

The information that is not publicly available that was included in Mercury’s shareholder information on the
Companies Office website was:
• each shareholder's email address (if provided)
• each shareholder's Common Shareholder Number (CSN), and
• the numeric identifier used by our registrar (also referred to as a Holder Number) for each
shareholder.
The CSN and Holder Numbers are unique to each holder, whether an individual, company or trust.

Note: The information did not contain bank account information. It did not include shareholders’ Authorisation
Codes (sometimes known as a FIN) or signatures required to effect a share transaction.

How concerned should you be?
We believe that it is extremely unlikely that anything adverse has occurred because of this mistake.

What has Mercury done about it?
• Immediately on becoming aware of the mistake, we had the information removed.
• The Companies Office has confirmed that the information was looked at only 12 times in total, on
three separate days, before the day we removed the information.
• Our share registrar has put in place additional monitoring of shareholder activity related to this
information.
• We reviewed and changed our own processes based on lessons learned.
• We informed the New Zealand Privacy Commissioner and the Australian Information Commissioner.

Our apology to you...
We are extremely sorry and apologise unreservedly for this mistake.

We regularly state our commitment to privacy and work hard to live up to that commitment. That is why this
simple mistake is as frustrating to us as it would be to you. We have put in place a change to prevent this
happening again. We don’t believe any negative consequences have been experienced by any shareholders
because of this mistake, but it shouldn’t have happened.

In the accompanying document we cover off some possible questions in more detail, and steps you can take
if you need further information.


Yours faithfully





Howard Thomas
Company Secretary

Mercury NZ Limited
PHONE:
+ 64 9 308 8200
mercury.co.nz
Level 3, 109 Carlton Gore Road, Newmarket 1023 New Zealand
FAX:
+ 64 9 308 8209

The detail and things to consider

What exactly happened and why?
Each November we are required to submit our Annual Return, including details of our top 10 shareholders, to
the Companies Office. During our filing in November 2017, we inadvertently and incorrectly lodged details of
all our shareholders, not just the top 10.

The information lodged by mistake is mostly publicly available. It comprises the name, address, and the
shareholding of each shareholder. That information can be accessed by someone making a request under
section 215 of the Companies Act 1993 or section 221 of the Financial Markets Conduct Act 2013.

This information would not normally include shareholders’ email addresses, Common Shareholder Numbers
(CSN) or numeric identifiers (Holder Numbers) allocated by our registrar, as our list incorrectly did.

The moment it was brought to our attention, working with the Companies Office we had the list removed.

When were you alerted to the presence of the information on the Companies Office website?
On 16 May. We took immediate action to have it removed and started an investigation to understand how
this occurred and what risk it posed to shareholders.

Who alerted Mercury to the availability of the information?
A person with legitimate reason for inspecting the Companies Office filing. We appreciated them raising their
concern with us so that we could take appropriate action.

Do you know who viewed the information and/or how many times the information was viewed?
The Companies Office has confirmed that the file containing the information was viewed only 12 times prior
to 16 May. The first view occurred in mid-February and then on two other days. It is most likely this file was
of interest to those who are involved in the capital markets.

Our registrar reviewed activity across the period and didn’t identify anything of concern.

What’s the risk?
We believe that it is extremely unlikely that anything has occurred because of this sharing of additional
information via the Companies Office website. The information does not contain bank account information. It
does not include the Authorisation Code (FIN) or signatures required to effect an on market transaction. It
was viewed only a limited number of times. There is a very low risk of the information being used by anyone
to contact you.

What about my CSN?
Your CSN cannot solely be used for trading shares on market, as this also requires a different number: your
Authorisation Code (FIN), which you should hold privately. The company does not have your Authorisation
Code (FIN) and would never ask you for it.

Your CSN or our registrar’s Holder Number could be used for off market trades. However, we are confident
that our share registrar’s processing of off market trades is robust. As a precaution, we have agreed
additional controls to be implemented for off market trades.

We note that for off market transfers, the seller and buyer are both informed of the transaction via a
Securities Transaction Statement. A record of all transfers is maintained by our registrar.

What should I do as a shareholder?
It is good general practice to be wary of any unsolicited approaches you get in relation to your shares, as
well as requests for further information, such as attempts to get you to share your Authorisation Code (FIN).

You should not share your Authorisation Code (FIN) with anyone except when you want to engage with your
share broker (be very wary of spam email or phone calls), or when registering online on our registrar’s
Investor Centre.

You should review correspondence from our registrar relating to activity on your account and as usual, if you
receive approaches from anyone in relation to your shareholding, seek appropriate advice.

If you have any concerns, you can take the extra step of changing your CSN or your Holder Number.
That can be done by contacting our registrar by telephone or email as outlined below. There is no
cost involved.

Can anyone access financial information or transfer shares with this data?
No. Transferring shares on market requires an Authorisation Code (FIN), which you should hold privately, as
well as a signature.

Your CSN or our registrar’s Holder Number could be used for off market trades. However, we are confident
that our registrar’s processing of off market trades is robust. As a precaution, we have agreed additional
controls to be implemented for off market trades.

Is there a problem with your security / was the information hacked?
No. This does not reflect on our IT security. It was a mistake for which we sincerely apologise.

What is Mercury doing to ensure such a mistake won’t happen again?
We have changed the process for lodging information to the Companies Office to prevent a recurrence.


For queries:

To talk about your shareholding, or your CSN or other details, please call the Mercury share registrar,
Computershare, on 0800 650 034 (in New Zealand), 1800 832 718 (in Australia) or +64 9 488 8777 (if you
are overseas), or email mercury@computershare.co.nz.

If you have any other questions or concerns, please phone us: 0800 67 74 27, or +64 9 526 8271, or email
shareholder@mercury.co.nz.