New Zealand’s National Cyber Security Centre (NCSC) has reported a rise in cyber security incidents requiring specialist intervention, despite overall reporting volumes remaining broadly unchanged in the second quarter of 2026. According to the agency’s latest Cyber Security Insights report, the increase reflects growing complexity and potential national impact associated with some attacks affecting individuals, businesses and public organisations.
Between 1 April and 30 June 2026, the NCSC responded to 1,129 incident reports, slightly below the 1,164 reports recorded during the previous quarter. However, 92 incidents required specialist technical support because of their potential national significance, compared with 77 incidents in the first quarter of the year.
Increase in incidents with wider national impact
The National Cyber Security Centre said the figures indicate that while cyber incident reporting has stabilised, more cases are presenting elevated risks to organisations and critical systems. Deputy Director-General Catriona Robinson said the reporting trends help authorities better understand the evolving threat environment across the country.
“New Zealanders continue to report cyber security incidents at a consistent rate, which helps us build a stronger understanding of the threats affecting individuals, businesses and organisations across the country. While the total number of reports has remained relatively stable, we are seeing an increase in incidents that require specialist technical support because of their potential national impact. We encourage New Zealanders to take action to prevent cyber security attacks as the impacts can be very damaging.” Catriona Robinson, Deputy Director-General, National Cyber Security Centre
The findings align with broader concerns around the changing cyber threat environment highlighted in recent reporting on how artificial intelligence is reshaping cyber threats in New Zealand. Public agencies and businesses are increasingly facing sophisticated attacks that combine fraud, social engineering and malware.
Financial losses decline but risks remain significant
Reported direct financial losses totalled NZ$2.7 million (approximately US$1.6 million) during the quarter, representing a 52% decline from NZ$5.6 million (approximately US$3.3 million) reported in the first quarter of 2026.
Scams and fraud were the most commonly reported incident category, accounting for 348 incidents and around NZ$860,000 (approximately US$510,000) in reported losses. Phishing and credential harvesting incidents ranked second among reported categories.
Although less frequently reported, unauthorised access incidents generated the largest financial impact. These incidents accounted for approximately NZ$1.3 million (approximately US$770,000) in losses, representing around half of all reported financial losses during the quarter.
The continued prevalence of scams and fraud reflects wider efforts across New Zealand to improve cyber resilience and public awareness. Recent initiatives focusing on fraud awareness and resilience have highlighted the importance of coordinated prevention measures across government, industry and the community.
Growing concern over malware and QR code phishing scams
The NCSC reported an increase in malware-related scams during the quarter. These scams typically involve cyber criminals persuading victims to install malicious software capable of stealing sensitive information or compromising devices.
To support public awareness, the latest Cyber Security Insights report includes guidance on recognising malware threats and QR code phishing scams. The report explains how attackers use deceptive QR codes to redirect users to fraudulent websites or encourage the disclosure of personal information.
QR code phishing has attracted greater public attention in New Zealand following incidents involving parking meters in Christchurch. The NCSC advised individuals to exercise caution before scanning unfamiliar QR codes and to verify links before entering personal or financial information.
The findings also reinforce the need for organisations, including small and medium-sized enterprises, to strengthen cyber security practices as threats continue to evolve. Recent analysis of how New Zealand SMEs are improving cyber security resilience has identified increasing investment in staff awareness, monitoring systems and incident response capabilities.
This article is created with the assistance of OpenGov AI.