Learning from Others’ Mistakes: Real Cyber-Breach Insights for NZ Businesses

Cyber Escalation in NZ

New Zealand has seen a sharp increase in cyber incidents over the past year. The National Cyber Security Centre reported 1,249 incidents in the third quarter of 2025 alone, with financial losses ballooning. This trend peaked with the ManageMyHealth breach on December 30, 2025, where hackers accessed 108GB of data including names, medical records, test results, and prescriptions from a popular patient portal.

The attack demanded a US$60,000 ransom by January 15, 2026, threatening to release the information on the dark web. Over 126,000 individuals were affected, marking one of the largest privacy violations in the country's history. Similar incidents, like the Tonga health system ransomware in June 2025 that shut down services for nearly a month, and the Qantas data exposure in mid-2025 impacting millions, show a regional pattern targeting sensitive sectors.

Broader impacts ripple through the economy. Large businesses reported 69% attack rates in 2024, with 46% taking over a month to resolve. The NCSC's 2025 Cyber Threat Report highlighted $26.9 million in direct losses, excluding wider damages like reputational harm or operational halts. Health providers, in particular, face eroded patient trust, potential identity theft risks for victims, and heightened scrutiny from regulators.

Stakes are concrete and urgent. The Privacy Amendment Act 2025, assented in September and effective May 1, 2026, mandates new notification requirements for indirect data collection, raising compliance costs and penalties for breaches. Inaction invites further exploitation: Cyble documented 92 initial access sales targeting Australia and New Zealand firms in 2025, fueling industrialized cybercrime.

Non-obvious angles include governance gaps in third-party platforms. The ManageMyHealth case exposed weaknesses in data handling, echoing global issues like the MOVEit breaches. Tensions arise between stakeholders—health organizations prioritize accessibility, while regulators demand robust safeguards. Trade-offs involve balancing AI-driven attack automation against resource-strapped defenses, where small businesses often lag. Surprising data: State-sponsored actors accounted for 32% of significant incidents, blending espionage with criminal motives in ways that blur traditional threat lines.