Follow Beinsure
New Zealand medical device manufacturer Fisher & Paykel Healthcare (NZX: FPH) has disclosed a cybersecurity incident involving unauthorised access to two employee email accounts and a subset of company files, some containing personally identifiable information (PII).
The company said it activated its incident response procedures and began investigating the nature and extent of the unlawful activity. It is notifying affected individuals and has informed the relevant authorities.
- Fisher & Paykel Healthcare confirmed unauthorised access to two employee email accounts and company files containing personally identifiable information.
- The company found no evidence of ransomware, malware or compromised patient data systems and expects no material financial or operational impact.
- The breach follows rising cyber threats in New Zealand, where insurers are increasing scrutiny of authentication controls and third-party exposure despite soft insurance pricing.
“There is no evidence that the unlawful activity compromised the company’s system that maintains patient data,” Fisher & Paykel Healthcare said in its announcement to the New Zealand Exchange (NZX).
The manufacturer, which produces medical devices used to treat obstructive sleep apnoea, confirmed that its products, manufacturing operations and supply chain had not been affected.
It believes the incident has been contained, with no evidence of ransomware or malware identified during the investigation. The company does not expect the breach to have a material impact on its financial performance or operations.
Fisher & Paykel Healthcare has not identified the initial method used to access its systems. Although compromised employee email accounts can indicate phishing or stolen credentials, the company has not confirmed either as the cause.
Shares in Fisher & Paykel Healthcare fell as much as 1.5% to NZ$48.68 during the trading session following the disclosure.
The incident was reported a day after critical vulnerabilities in the widely used PHP programming language prompted government websites across Europe and other regions to go offline while operators installed security updates. No connection between the two incidents has been established.
New Zealand cyber threats rise despite soft insurance market
The Fisher & Paykel Healthcare breach adds to a series of cybersecurity incidents affecting New Zealand organisations, even as the country’s cyber insurance market continues to offer relatively favourable conditions for buyers.
According to the National Cyber Security Centre’s (NCSC) Cyber Threat Report 2026, the agency handled 369 incidents of potential national significance during 2025/26.
Of those incidents, 162 were associated with criminal or financially motivated actors, representing an 18% increase from the previous year.
Four incidents received a C2 classification, indicating highly significant severity. This was the first time in five years that incidents had reached that classification.
Insurance market conditions have not followed the same trajectory. Aon classified New Zealand’s cyber insurance market as soft in the first quarter of 2026, citing abundant underwriting capacity and broader coverage availability.
For insurance brokers, the difference between rising cyber threats and competitive insurance pricing creates an opportunity to review clients’ existing cyber programmes, particularly where coverage has not been tested following a significant incident.
The Fisher & Paykel Healthcare disclosure also demonstrates how unauthorised access to employee communications and internal files can expose personal information without disrupting production or compromising systems containing patient records.
Healthcare cybersecurity incidents and privacy regulation
The incident follows several significant data breaches involving New Zealand’s healthcare sector over the preceding 12 months.
- In December 2025, attackers used stolen credentials to breach Manage My Health, the country’s largest patient health portal. The attack exposed medical records belonging to nearly 100,000 New Zealanders.
- In September 2026, the Office of the Privacy Commissioner (OPC) issued compliance notices to Manage My Health and Health NZ.
The regulator found that multi-factor authentication (MFA) had been available but was not mandatory when the attack occurred.
Privacy Commissioner Michael Webster said that “health information by its nature is sensitive personal information”. He also raised concerns about the strength of New Zealand’s existing privacy legislation, stating that the Privacy Act 2020 “does not provide sufficient incentives for many organisations” to invest in adequate information security safeguards.
Under the Act, organisations must notify the Privacy Commissioner when a privacy breach causes, or is likely to cause, serious harm.
Financial penalties remain limited. According to the OPC, fines of up to NZ$10,000 apply only to a narrow range of procedural offences. The legislation does not impose civil penalties for breaches of the information privacy principles themselves.
Regulatory statistics indicate that reported privacy incidents are increasing.
Notifications to the Privacy Commissioner rose 26.5% between the 2023/24 and 2024/25 financial years, while notifications involving serious harm increased 43% over the same period, according to the Commissioner’s quarterly report to the Minister of Justice.
These figures provide additional context for healthcare organisations and their insurers, particularly where compromised credentials and inadequate access controls can expose sensitive information.
Cyber insurance underwriting focuses on MFA and third-party risks
The Fisher & Paykel Healthcare incident raises questions for brokers reviewing cyber insurance coverage, particularly around employee account security, third-party dependencies and the circumstances under which policies respond to a breach. Multi-factor authentication has become a baseline requirement in cyber insurance underwriting.
In April 2026, NSP cyber chief information security officer Geordie Stewart told members of the Insurance Brokers Association of New Zealand (IBANZ) that obtaining cyber insurance without MFA would be “very difficult”.
Insurers increasingly expect MFA to protect email accounts, remote access systems, virtual private networks (VPNs) and administrator accounts. Those controls may also be verified during the claims process, making their implementation relevant to both obtaining coverage and demonstrating compliance with policy requirements.
Third-party technology dependencies present another area for review. In May 2026, a supply-chain attack involving the Canvas learning platform affected more than 30 tertiary institutions and schools across New Zealand.
According to the Ministry of Education, the incident compromised information relating to an estimated 110,000 to 120,000 students and staff.
For brokers, the case raises the question of whether clients’ cyber policies respond to losses caused by security breaches at external technology providers, rather than only incidents originating within an insured organisation’s own systems.
The distinction is particularly relevant for businesses that depend on cloud services, external platforms and vendors handling confidential or personal information.
Proposed cyber regulations could increase financial exposure
New Zealand is also considering changes to cybersecurity requirements for critical infrastructure operators. Proposed rules, for which consultation closed in April 2026, would introduce mandatory incident reporting within 72 hours.
The proposals also include potential financial penalties of up to NZ$5 mn or 2% of annual turnover for entities, alongside penalties of up to NZ$500,000 for individual directors.
The measures would represent a change in regulatory expectations for affected organisations, particularly around incident reporting and accountability.
Aon New Zealand cyber practice leader Duncan Morrison said that “our regulators are nowhere near as punitive as the likes of Australia”.
Nevertheless, the proposed requirements would increase the importance of incident response planning and compliance for organisations falling within their scope.
For brokers assessing cyber insurance renewals, the immediate issues include whether clients have implemented MFA across critical accounts, understand their exposure through third-party providers and maintain procedures for identifying and responding to security incidents.
Fisher & Paykel Healthcare’s expectation of no material financial or operational impact may limit the immediate insurance implications of its breach. The exposure of personally identifiable information, however, means the company must still manage notifications to affected individuals and the relevant authorities.
