New Zealand cyber report naming China draws swift rebuke from Beijing

Report points to state-linked activity

The NCSC’s 2026 Cyber Threat Report, released on September 24, assesses risks to New Zealand businesses and organisations from cybercrime, artificial intelligence, state actors and supply-chain exposure.² The agency said it handled 369 incidents of potential national significance in 2025/26, including 86 assessed as linked to suspected state-sponsored actors.³⁵

The NCSC said suspected state-sponsored activity over the past year targeted New Zealand government agencies, health and education organisations, and information technology managed-service providers, putting sensitive information at risk.¹ It linked activity to suspected actors from China, Russia, Iran and North Korea, but singled out China as the most persistent and capable state actor operating against New Zealand.¹

Reuters, citing the NCSC report, said the cases included activity against government agencies and organisations in health, education and information technology. It noted that the assessment follows broader warnings by Western-aligned intelligence agencies about alleged Chinese cyber espionage.⁵ The Straits Times’ regional coverage also framed the report as naming China while highlighting cyber risks to government and key sectors.⁶

Beijing rejects the allegation

Beijing’s response was direct. Guo said China “opposes and resolutely fights hacker attacks in accordance with law” and accused New Zealand of spreading cyber-security disinformation for political purposes.⁴ The Foreign Ministry also called on Wellington to foster mutual understanding and trust between the two countries.⁴

The denial is consistent with China’s repeated rejection of Western cyber-espionage allegations. But the timing — a same-day response to a New Zealand government report — underscores how public attribution has become part of bilateral diplomacy, not just a technical warning to network defenders.

Pacific security dimension

The NCSC placed the threat in a broader strategic context, saying state-sponsored cyber activity is occurring amid geostrategic competition, conflict and international tensions.¹ It warned that cyber tools can be used for espionage, intimidation, intellectual-property theft, disruption and, in some cases internationally, sabotage.¹

The report also pointed to the South Pacific, saying New Zealand was aware of state-sponsored cyber espionage targeting governments and infrastructure in the region.¹ That framing matters for Wellington’s security policy. New Zealand describes itself as a Pacific country with close family, cultural, political and economic ties across the region, and the NCSC warned that such targeting could affect citizens, businesses and civic institutions.¹

For New Zealand, publicly naming China fits a broader shift in cyber policy toward national security strategy. The NCSC said that in April 2026, New Zealand joined other countries in warning about China-affiliated actors’ use of covert networks of compromised devices. In August 2025, it joined partners in identifying activity by PRC state-sponsored actors targeting networks globally, including telecommunications, government, transport, lodging and military infrastructure.¹

AI and cybercrime remain central risks

While the diplomatic dispute centres on China, the NCSC report also stresses that artificial intelligence and financially motivated cybercrime are reshaping the threat environment. The agency said 162 of the 369 incidents of potential national significance in 2025/26 were linked to criminal or financially motivated actors, an 18% increase from the previous year.³

NCSC head Catriona Robinson said cyber security had become a critical consideration for every New Zealand business and organisation, with frontier AI expected to increase the speed, scale and sophistication of attacks.³ The report warns that malicious actors may use AI for faster vulnerability identification, reconnaissance, brute-force attacks, phishing and deepfakes.²

Even so, the China attribution is likely to draw the most regional attention. For security readers across the Asia-Pacific, the core development is not only that New Zealand has identified a state-linked cyber threat. It is that naming the alleged actor has itself become a contested act of diplomacy.