New Zealand has identified China as its most persistent and capable state-backed cyber threat, warning that foreign cyber operations are increasingly targeting government agencies, critical organisations and sensitive information across the country.
The assessment was published in New Zealand’s 2026 Cyber Threat Report by the National Cyber Security Centre, which said suspected state-sponsored activity had been linked to China, Russia, Iran and North Korea. Of those countries, the agency identified China as the most persistent and capable state actor conducting cyber activity against New Zealand.
The NCSC said it had handled 369 cyber incidents considered to have potential national significance during the year to June 2026. Of those, 86 were suspected of having links to state-sponsored actors, with targets including government agencies, health and education organisations and managed IT service providers.
The agency warned that state-backed cyber activity is not necessarily limited to immediate attacks or attempts to steal information. Hackers can conduct reconnaissance and establish access inside networks for months or even years before using that access for espionage, disruption or other operations.
That creates a particular concern for organisations operating critical infrastructure, essential public services and systems containing sensitive government or personal information.
New Zealand has also pointed to the wider geopolitical competition unfolding across the South Pacific. The NCSC said it is aware of state-backed cyber espionage targeting governments and infrastructure in the region, raising concerns that cyber operations could increasingly accompany strategic competition between major powers.
The report also highlights previous international warnings involving Chinese-linked cyber groups.
In April 2026, New Zealand joined nine other countries in warning about the large-scale use of networks of compromised devices, including home routers, to conceal malicious cyber activity. The NCSC linked such activity to China-affiliated groups including Volt Typhoon and Flax Typhoon, which have been associated with attempts to target infrastructure networks.
New Zealand previously joined other governments in warning about Salt Typhoon, a Chinese state-sponsored group accused of targeting telecommunications, transport and government networks globally. The campaign involved exploiting vulnerabilities in network equipment and was associated with espionage and the harvesting of data, credentials and network information.
The latest assessment comes only weeks after New Zealand’s Security Intelligence Service said China was the only country it had detected conducting espionage in the country “at scale.” The two assessments reinforce Wellington’s growing concern about Chinese state-linked activity, although the findings relate to suspected activity identified by New Zealand authorities rather than publicly proven responsibility for every individual cyber incident.
Beijing has rejected the allegations.
A Chinese Foreign Ministry spokesperson said China opposes and acts against hacking attacks in accordance with the law and accused the relevant New Zealand authorities of spreading false information and creating conflict. China has consistently denied accusations of state-sponsored cyber espionage.
The report also warns that the cyber threat is changing because of artificial intelligence. The NCSC said AI is making phishing, scams and social-engineering attacks more convincing, while cybercriminals are becoming increasingly organised and aggressive.
Of the 369 nationally significant incidents recorded during 2025/26, 162 were attributed to criminal or financially motivated actors, an 18 per cent increase from the previous year. Four incidents were classified as “Highly Significant” — as many as the agency had recorded during the previous decade combined.
For New Zealand, the challenge is therefore broader than Chinese cyber activity alone. State-sponsored operations, organised cybercrime and emerging AI-enabled threats are converging into a more complicated security environment.
The NCSC is urging businesses and organisations to strengthen basic cyber protections rather than assuming government agencies can protect every network from every threat. It says organisations should prepare for attackers who may remain inside systems undetected for extended periods.
The latest warning could also have wider implications for New Zealand’s relationship with China, one of the country’s most important economic partners. As Wellington increases attention on cyber security and intelligence threats, the challenge will be balancing security concerns with diplomatic and economic ties.
The bigger question now is whether the latest cyber warnings will lead to stronger international cooperation against state-backed hacking — or deepen an already growing technology and security divide between New Zealand and China.
