New Zealand’s National Cyber Security Centre, the government agency responsible for assessing major cyber threats, has identified China as the country’s most persistent and capable state-backed cyber actor.
The assessment appears in the NCSC’s Cyber Threat Report 2026, which covers incidents handled between July 2025 and June 2026.
The agency said suspected foreign state actors targeted New Zealand government bodies, health and education organisations, alongside IT managed-service providers.
The NCSC linked suspected state-sponsored activity during the period to actors associated with China, Russia, Iran and North Korea. Among those countries, the agency assessed the People’s Republic of China as the most persistent and capable source of state-backed cyber activity affecting New Zealand.
The finding adds to previous assessments from New Zealand intelligence agencies concerning Chinese espionage activity. In August, the New Zealand Security Intelligence Service said China was the only state it had detected conducting espionage against the country at scale.
Beijing rejected the latest allegations. Chinese Foreign Ministry spokesperson Guo Jiakun said China opposes hacking attacks and accused the New Zealand agency of spreading false information for political purposes.
China has repeatedly denied Western government accusations that it sponsors cyber espionage operations. The New Zealand assessment therefore represents the NCSC’s attribution and threat judgement rather than an allegation accepted by the Chinese government.
State-linked incidents accounted for a substantial share of the more serious cyber cases handled by the NCSC during the latest reporting year. Of 369 incidents assessed as having potential national significance, 86 showed suspected links to state-sponsored actors.
That represented 23% of incidents receiving specialist NCSC analysis and support. The comparable number in 2024/25 was 82 incidents, according to the agency.
Government organisations were among the targets identified during the year, alongside health and education bodies. Managed IT service providers also drew state-backed interest because access to one provider potentially offers a route into several customer environments.
The NCSC said these incidents placed sensitive New Zealand information at risk.
State-backed operators frequently pursue intelligence rather than immediate financial returns, making their activity different from ransomware groups and other criminal actors seeking payment.
New Zealand authorities also see growing cyber competition across the South Pacific. The NCSC said it was aware of state-sponsored espionage targeting governments and infrastructure elsewhere in the region, where New Zealand maintains extensive political, economic and family connections.
Those relationships create potential secondary exposure for New Zealand organisations. Compromise of government or infrastructure networks elsewhere in the Pacific could affect businesses, citizens and public institutions linked through regional systems and services.
The agency expects state-backed groups to concentrate on organisations operating infrastructure, supplying essential public services or holding information with diplomatic, military or economic value. Technology providers remain attractive because their systems often connect with multiple organisations.
Cyber espionage frequently develops over longer periods than conventional cybercrime. According to the NCSC, state actors sometimes conduct reconnaissance or establish access months or years before using compromised systems for intelligence collection or other activity.
That operating model makes detection difficult. An intrusion doesn’t always produce an immediate outage, ransom demand or obvious disruption, leaving attackers with time to study networks and maintain access.
The NCSC said the main purpose of state-sponsored activity detected in New Zealand has been espionage. Internationally, New Zealand’s intelligence partners have also associated state actors with intellectual property theft, intimidation and disruption of networks or essential services.
The report comes as New Zealand records a wider increase in serious cyber incidents. Criminal and financially motivated activity accounted for 162 of the 369 incidents of potential national significance during 2025/26, up 18% from the previous year.
State-backed activity remained smaller by incident count but carries different strategic risks because targets often include government systems, infrastructure and organisations holding sensitive information.
The NCSC’s assessment doesn’t attribute every suspicious incident to a specific government. Cyber attribution depends on technical evidence, infrastructure patterns, methods and intelligence that often produce varying levels of confidence rather than definitive identification.
