Cybersecurity Incidents in New Zealand: Q1 and Q2 2026 Overview

• •Q1 2026 saw 1,164 cybersecurity incidents with losses of NZ$5.6 million.
• •Phishing and credential harvesting were the most common attack methods reported.
• •Q2 2026 recorded a decrease in incidents to 1,129, with losses dropping to NZ$2.7 million.

In the first quarter of 2026, New Zealand's NCSC recorded 1,164 cybersecurity incidents, resulting in direct financial losses of NZ$5.6 million, a 76% increase from the previous quarter. The most common incidents were phishing and credential harvesting, with scams and fraud causing significant losses. Three incidents were categorized as C2, impacting sensitive data and essential services. In the second quarter, incidents slightly decreased to 1,129, with reported losses dropping to NZ$2.7 million, a 52% decrease. Scams and fraud were the most common types reported, with unauthorized access causing a notable loss of NZ$1.3 million. The NCSC noted an increase in malware scams targeting New Zealanders, particularly through creative schemes to deceive users into downloading malicious software.