Welcome to SOCRadar's New Zealand Flash Report: Six Months of Supplier Breaches and Data Extortion!

• Cyber Threat Activity Spans Multiple Sectors: SOCRadar identified 41 New Zealand organizations named in incidents or claims between May 10 and November 10, 2026, with 11 confirmed incidents and 30 unverified or under investigation.
• Supplier Breaches Drive Significant Exposure: Five of the 11 confirmed incidents involved suppliers, partners, or shared platforms, while another resulted from a vulnerability in third-party software.
• Healthcare Data Faces Serious Risks: The ZenTech ransomware breach resulted in 67.1 GB of published data, including Health New Zealand and Coroners Court information, highlighting the consequences of sensitive records remaining with former contractors.
• Education Providers Face Widespread Third-Party Risk: The Canvas breach affected more than 30 New Zealand education providers and potentially 110,000 to 120,000 people.
• Finance and Insurance Are Frequently Named: The sector accounts for 11 of the 41 organizations identified, although ten of those entries remain unverified, emphasizing the need to distinguish confirmed breaches from threat actor claims.
• Large Data Sales Require Verification: Four underground listings advertised datasets containing 1.5 million records or more, but none of the claimed record counts has been independently verified.
• Stolen Credentials Remain a Major Threat: Listings containing more than 18,000 New Zealand email and password pairs appeared during the period, creating potential opportunities for account compromise and further attacks.
• Ransomware Activity Is Highly Fragmented: Fourteen groups accounted for 18 New Zealand leak-site listings during 2026, including nine within the report’s six-month period. The Gentlemen and Clop recorded three listings each across the year.
• Cybercrime Extends Across Australia and New Zealand: Threat actors frequently advertise data from both countries, particularly customer information linked to financial services, investment platforms, and commercial organizations.
• Cyber Incidents Are Becoming More Serious: New Zealand’s NCSC recorded 369 incidents of potential national significance in its 2025/26 reporting year, including four highly significant incidents, despite an overall decline in reported incidents.

Why This Report Matters

New Zealand’s cyber threat landscape shows that organizations increasingly face risks extending beyond their own infrastructure. Supplier breaches, compromised shared platforms, and exposed credentials can affect multiple organizations through a single incident. Healthcare and education cases demonstrate how sensitive information can remain vulnerable even when stored or processed by external providers.

The report also highlights the importance of distinguishing verified incidents from unconfirmed underground claims. While ransomware and data extortion remain persistent threats, many advertised breaches lack supporting evidence, and older datasets are frequently repackaged as new leaks. Organizations need reliable threat intelligence to identify genuine exposure, monitor third-party risks, and prioritize responses based on confirmed threats.

For healthcare, education, finance, government, and other New Zealand organizations, stronger supply chain visibility, credential protection, ransomware preparedness, and Dark Web monitoring are essential to protecting sensitive information and maintaining operational resilience.

Take Action Now

• Dark Web Monitoring: Detect leaked databases, exposed credentials, stolen customer records, and unauthorized access listings tied to New Zealand organizations.
• Supply Chain Security: Monitor third-party providers, shared platforms, and external partners for breaches that could expose organizational or customer information.
• Ransomware Intelligence: Track The Gentlemen, Clop, Qilin, and emerging extortion groups targeting New Zealand and Australian organizations.
• Access Security: Strengthen MFA, monitor compromised credentials, secure remote access, and reduce risks associated with third-party vulnerabilities.
• Data Protection & Incident Response: Review sensitive information held by suppliers, strengthen breach detection, and prepare response procedures for data theft and extortion incidents.