Immigration NZ stored boxes with more than 1000 personal files including bank statements and copies of passports in a publicly-accessible foyer.
The 17 boxes were stacked in a lift area next to the agency's office on the sixth floor of a Palmerston North building.
The lifts weren't swipe access and during work hours any member of the public or person visiting the office could access the area with the boxes.
The privacy incident was discovered in February last year. The files were copies of online applications from international students, sent on to Immigration NZ from education organisations.
They contained bank statements, application forms with personal details, copies of passports and visa labels, offers of place for study and tuition fee receipts.
It's likely more than 1000 applications were in the boxes.
An email from an Immigration NZ officer describing the breach noted one box was ripped open, meaning anybody could have pulled files out: "this was how we (health and safety team) realised that these were actually online applications".
"As soon as we discovered these, we notified our health and safety manager rep and our branch manager. The boxes were immediately brought back inside the branch within one hour of notifying them," the officer wrote in an email, released under the Official Information Act.
"I believe they may have been put there due to lack of space ... however, this is no excuse for leaving them in an area where any member of the public has access to them."
The Ministry of Business Innovation and Employment (MBIE), which includes Immigration NZ, said it appeared the boxes were moved into the foyer on the morning of February 16, and they were removed the following afternoon.
An access card isn't required during work hours to get to the 6th floor lobby, but signage on the ground floor advises people there is no public access.
"It's an area highly trafficked by Immigration NZ staff and we are confident that any non-staff member could not have spent any length of time in the foyer unnoticed," an MBIE spokeswoman said.
"Immigration NZ also confirmed all the files were present and no information was missing from any box. While one of the boxes was damaged, the contents were not disturbed and the files were bound together in alphabetical order."
The Herald has asked government organisations to detail cases since 2016 when material had been mistakenly left unaccompanied in public.
Seventeen organisations confirmed over 65 incidents, including an NZSIS staff member leaving a locked bag with sensitive information in a cafe bathroom.
The Ministry of Business Innovation and Employment (MBIE) had three other incidents, including a laptop left on a train and a staffer who put a file on a car roof and then drove off.
Inland Revenue also disclosed seven incidents since 2016, including a staff member who left his briefcase in a bar and another employee leaving a laptop in an Auckland park after a meeting.