New Zealand Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, New Zealand
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for New Zealand, checked 7 Nov 2026. New Zealand publishes no cyber threat level; the NCSC grades incidents from C1 to C6 and publishes quarterly insights and an annual threat report.
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
| New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Chinese government-linked actors using Integrity Technology Group tools | State-aligned | NCSC joined partners in an advisory on these actors stealing data from government and healthcare victims. | NCSC |
Laws and rules this year
Full stories
- Mathspace student data breach hits 1.08 million people Australia, New Zealand · 3 Sep 2026
Official statements
- 9 Oct 2026NCSC joined an international advisory on Chinese government-linked actors combining automated and hands-on hacking tools. NCSC
- 23 Sep 2026Privacy Commissioner issued compliance notices to Manage My Health and Health NZ. Office of the Privacy Commissioner
- 27 May 2026Privacy Commissioner found Manage My Health and Health NZ breached the Health Information Privacy Code. Office of the Privacy Commissioner
- 21 Jan 2026Privacy Commissioner announced an inquiry into the Manage My Health breach. Office of the Privacy Commissioner
Incidents
9 of 9 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedMathspace (NZ users)Full story | 3 Sep 2026 | Education | Data leak | None | Confirmed. Mathspace said stolen data covered students, parents and staff in Australia and New Zealand, 1,079,819 people in total. | BleepingComputer✓ 7 Nov |
| ⚠️ ClaimedWarwick Fabrics (NZ) | 3 Jul 2026 | Retail | Ransomware | Claimed. Kairos listed the New Zealand arm of the textile wholesaler on 3 July and claimed to have stolen 386 GB of data. | Cyber Daily✓ 8 Nov | |
| ⚠️ ClaimedAlpha Group Holdings | 24 May 2026 | Manufacturing | Ransomware | Claimed. Qilin listed the Auckland health supplements maker on its leak site on 24 May without publishing any data samples. | Insurance Business NZ✓ 8 Nov | |
 ✅ ConfirmedMcKay | 30 Apr 2026 | Other | Intrusion | Confirmed. The Whangarei electrical contractor confirmed on 4 May a January cyber attack involving unauthorised access to a single device. Claimed. The Mnt6 group listed McKay on its leak site on 30 April. | Cyber Daily✓ 8 Nov | |
 ✅ ConfirmedHutt City Council | 29 Apr 2026 | Government | Intrusion | None | Confirmed. The council said a March phishing attack gave unauthorised access to several staff email accounts. Five people had identity information compromised and 732 may have had financial information exposed. | 1News✓ 8 Nov |
 ✅ ConfirmedMediMap | 24 Feb 2026 | Health | Intrusion | None | Confirmed. The medication management platform used by aged care and community providers confirmed unauthorised entry on 22 February. Some patient records were altered and the platform went offline while providers reverted to manual processes. | RNZ✓ 8 Nov |
| ✅ ConfirmedLangley Twigg Law | 26 Jan 2026 | Other | Ransomware | Confirmed. The Napier law firm said a malicious third party attacked its network on 11 January and extracted part of its file server, including client documents. Police and the Privacy Commissioner were notified. Claimed. The Anubis ransomware group posted data it said was stolen from the firm. | RNZ · BeyondMachines✓ 8 Nov | |
| ✅ ConfirmedCanopy Health | 12 Jan 2026 | Health | Intrusion | None | Confirmed. Canopy Health, the largest private medical oncology provider, confirmed someone gained unauthorised access to part of its administration systems in July 2025 and some data may have been copied. Patients were told months later. | RNZ✓ 8 Nov |
 ✅ ConfirmedManage My HealthVia a vendor | 1 Jan 2026 | Health | Data leak | None | Confirmed. Manage My Health notified the Privacy Commissioner on 1 January of a serious breach from December 2025; the Commissioner later found patient data of nearly 100,000 people was stolen and put up for sale. | Office of the Privacy Commissioner · Office of the Privacy Commissioner✓ 7 Nov |
FAQ
Does New Zealand have a national cyber threat level?
No published national cyber threat level was found for New Zealand (checked 7 Nov 2026). New Zealand publishes no cyber threat level; the NCSC grades incidents from C1 to C6 and publishes quarterly insights and an annual threat report.
Which organisations in New Zealand confirmed cyber incidents recently?
7 incidents confirmed since January 2026: Mathspace (NZ users), McKay, Hutt City Council, MediMap, Langley Twigg Law, Canopy Health and Manage My Health.
Which New Zealand organisations appear on ransomware or leak sites?
2 claims, not confirmed by the organisations: Warwick Fabrics (NZ) and Alpha Group Holdings.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.