Confidential patient details of all the active Covid-19 cases in New Zealand have been leaked, including their names and dates of birth.

The massive breach of privacy contains the details of 18 confirmed cases, ranging from a 30-year-old woman in Auckland to a 70-year-old man in Canterbury.

It includes the personal details of the man in his 30s receiving care in Auckland City Hospital.

The leaked spreadsheet, seen by the Weekend Herald, also shows which border facility the Covid-positive people were staying in when they tested positive and where they were moved for quarantine.

Newly appointed Health Minister Chris Hipkins said the leak was "totally unacceptable" and potentially criminal.

Hipkins took over the responsibility of the health portfolio on Thursday after David Clark resigned a series of blunders.

He has asked the State Services Commission, another portfolio Hipkins is responsible for, to work with the relevant agencies to ensure there is a thorough investigation.

"I have been advised by the Ministry of Health that at this stage it cannot be confirmed beyond doubt whether a deliberate leak was involved or if this was simply human error.

"If it was the former, it is unconscionable and absolutely beggars belief why anyone would feel it was an acceptable action to take, given the trauma it is likely to cause those whose information is involved. It would, quite frankly, be abhorrent, and potentially criminal.

"Either way, it cannot happen again.

"The public has every right to expect their private information to be held securely."

One Weekend Herald journalist has seen the spreadsheet. The information has been kept secure and the publication will not contact the people included in the leak.

The Office of the Privacy Commissioner said from the little information it had on the leak, it sounded "like a serious breach involving highly sensitive information".

"Should individuals make complaints to us or we learn additional information, we may investigate further."

The Health Ministry referred the Weekend Herald to Hipkins for a response. Director general of health Ashley Bloomfield is on leave.

The Ministry of Health publicly releases anonymised general details of every confirmed case - like their flight number - but withholds identifying features for privacy reasons.

But in March, it was forced to apologise when it accidentally identified people in two Hutt City clusters by publishing their names on its website.

The Government has come under pressure in the past month after revelations 50 people left managed isolation early on compassionate grounds without having a test despite the order for arrivals to be tested on day three and 12 of their stay.

It took the Health Ministry more than a week to establish how many were in that group despite daily questions from journalists.

Among those released early were two sisters who drove from Auckland to Wellington to visit their dying parent, met friends for directions and later tested positive for Covid-19.

The border blunder was among the reasons David Clark resigned as Health Minister on Thursday.

Bloomfield took responsibility for the errors as his ministry was in charge of operations and Clark later took ministerial responsibility.

There was public outrage in response to a video of Clark telling media Bloomfield had taken responsibility for the mistakes as the director general looked on.

Prime Minister Jacinda Ardern said she'd had a "frank" discussion with Clark, who had previously tendered his resignation over breaking lockdown rules, and they agreed he had become "a distraction" from the Covid-19 response.