Personal information held by Generate Kiwisaver, including name, address, IRD number was extracted by parties unknown. Approximately 26,000 of the 90,000 clients that have joined Generate over the last seven years have had personal information accessed illegitimately. Also up to 10,000 copies of documents (passports, driver licences) were possibly in that batch.

If you feel this could lead to identity theft you can request a new passport and driver licences. Not sure if the company would have to pay for these - perhaps get a lawyer and test the case?

The company has a privacy-related data breach FAQ here.