Cyber incidents of potential national significance targeting New Zealand’s healthcare and social assistance sector doubled in 2025-26, accounting for eight per cent of total incidents across all sectors – compared with four per cent the previous year, according to the National Cyber Security Centre (NCSC).
Approximately 30 potentially nationally significant incidents affected the healthcare and social assistance sector, compared with 12 the previous year.
In particular, NCSC’s Cyber Threat Report 2026 highlights the cyber attack on patient portal provider Manage My Health, which compromised more than 99,000 patient records, and an attack on medication management platform MediMap that disrupted services across aged care facilities, hospices and pharmacies.
The incidents demonstrate the risks associated with healthcare technology providers, where a security breach or service interruption can affect multiple organisations and their patients.
Across all sectors, the NCSC received 4673 cyber incident reports during the 2025-26 financial year, including 369 assessed as potentially nationally significant and four classified as highly significant.
In a statement, NCSC head Catriona Robinson urged organisational leaders to prepare for the growing impact of AI on cyber security.
“The cyber threat landscape is changing faster than ever. Alongside familiar threats from cybercriminals and state actors, businesses and organisations face a powerful new disruptor in the form of frontier artificial intelligence,” Ms Robinson said.
The report identifies AI, state-sponsored cyber activity, cybercrime and extortion, digital supply chains and social engineering as five major areas of concern.
The NCSC warns that AI is making it easier for malicious actors to find software vulnerabilities, automate cyber attacks and develop phishing campaigns.
It predicts that by early 2027, attackers could have access to advanced AI capabilities currently available only through leading frontier models.
The report also identifies risks for organisations adopting AI, particularly where chatbots and other applications have access to sensitive information. These systems can be manipulated through malicious prompts, while staff using unauthorised AI tools may expose confidential data.
The NCSC recommends stronger supply chain security, software patching and attention to vulnerabilities in legacy systems.
It also sees potential for AI to help organisations detect suspicious network activity and respond to attacks more quickly, provided existing security controls and human oversight remain in place.
Add Comment