New Zealand says China is its most persistent state-backed cyber threat

New Zealand report identifies China as its most persistent state-backed cyber threat, with foreign espionage actively targeting key government, health, education, and IT infrastructure network.

New Zealand's cyber security agency said China was the country's most persistent and capable state-backed cyber threat, as foreign actors targeted government agencies and organizations in sectors including health, education and information technology.

The National Cyber Security Center (NCSC), part of the New Zealand intelligence community, said it had identified activity suspected to originate from foreign state actors that put sensitive New Zealand information at risk.

It linked suspected state-sponsored cyber activity to actors from China, Russia, Iran and North Korea, according to its annual Cyber Threat Report released on Thursday.

"Of these nations, the People's Republic of China is the most persistent and capable state actor undertaking cyber activity in New Zealand," the report said.

The assessment is the latest warning from a Western-aligned intelligence agency over alleged Chinese cyber espionage, which Beijing has routinely denied. It follows a report from New Zealand’s security agency in August that said that China was the only country New Zealand had detected conducting espionage "at ​scale."

Chinese state-backed actors accounted for 86 nationally significant cyber attacks

The Cyber Security report said 86 of 369 cyber incidents deemed to be of potential national significance in the year to June 2026 had suspected links to state-sponsored actors. The incidents included activity targeting government agencies, health and education organizations, and IT managed-service providers.

The agency warned that geopolitical competition was increasingly playing out in the South Pacific, where it was aware of state-backed cyber espionage targeting governments and infrastructure.

New Zealand has close family, cultural, political and economic ties across the Pacific, and such activity could affect citizens, businesses and civic institutions, it said.

State-backed actors were likely to target organizations that operate infrastructure or networks, provide essential public services, or hold information that could offer a strategic advantage, the NCSC said.

It warned that cyber espionage can be difficult to detect, with actors conducting reconnaissance and positioning access in systems over months or years before using it for intelligence gathering or disruption.

Long-running intrusions could lead to the compromise of operational technology and the loss of corporate and personal data, it said.