New Zealand vs Australia: Sorry, but we're losing the cybersecurity race

When it comes to cyber threats in New Zealand and Australia, there's not much to choose between. It's pretty much same-same. Criminal groups want our money and data (and they're not fussy where it's from). State-sponsored actors are poking around our critical systems. And we're all leaning harder on third-party technology than ever before.

But what's telling is the way each country has responded. Because that's definitely not same-same.

It's all in the legislation

Got to say it. At this stage, Australia has it over us.

They've spent the past few years turning cybersecurity strategy into something with actual weight behind it: legislation, mandatory reporting requirements, and stronger protections around critical infrastructure. The works.

New Zealand's new Cyber Security Strategy 2026–2030 suggests we're heading in a similar direction. But we're dragging our heels in several areas, and recent incidents show exactly why closing that gap quickly matters.

Cyber risk is already costing us too much

New Zealand's National Cyber Security Centre (NCSC) recorded 4,673 cyber incidents in 2025/26.

Of these, 369 were serious enough to bring in specialist support because of their potential national significance.

Financially motivated cybercrime is the biggest driver. Of those nationally significant incidents, 44% were assessed as likely criminal or financially motivated. A further 23% were linked to suspected state-sponsored actors, with China and Russia among the most prominent.

Direct financial losses reached NZ$23.8 million in 2025/26.

The year before tells an even bigger story. In 2024/25, the NCSC recorded NZ$26.9 million in direct financial losses, and its detection and disruption work prevented another NZ$47.9 million in harm.

That last number is worth sitting with. It shows what's possible when organisations are prepared, and what it costs when they're not.

Here's the thing: cybersecurity is no longer just an IT problem. In recent years, the NCSC has been dealing with roughly one incident a day that could cause harm at a national level.

One. A day.

The Manage My Health breach showed what's at stake

Nothing makes this more real than an attack on our already stretched healthcare system.

One morning in December 2025, 99,000 everyday Kiwis woke up to the news that Manage My Health had been breached. Someone had gained unauthorised access to sensitive clinical and personal information, including uploaded documents, hospital discharge summaries, and specialist referral letters.

The Ministry of Health called it one of the most serious cyber incidents New Zealand has experienced. They weren't wrong.

The subsequent review found something telling: the breach didn't come down to a single weakness. It came from several. Which means that even when organisations invest in security technology, they're not automatically safe. Real cyber resilience depends on governance, oversight, and how well you manage the suppliers who touch your systems.

Health New Zealand's response has been thorough. Their action plan covers 19 priorities, including assurance assessments of six patient portals, a third-party risk-management framework, and an incident response guide. Credit where it's due.

But the problem is bigger than one incident.

New Zealand's Privacy Commissioner reported that between 2023/24 and 2024/25, privacy breach notifications jumped 26.5%, notifications involving serious harm jumped 43%, and privacy complaints rose 21%.

Those numbers are heading in the wrong direction.

But is Aussie doing any better?

Not necessarily at avoiding breaches. But yes, at building the rules around them.

Australia faces a massive cyber challenge of its own.

In 2024/25, the Australian Signals Directorate's Cyber Security Centre (ACSC) received more than 84,700 cybercrime reports. One every six minutes. It responded to more than 1,200 cybersecurity incidents, an 11% jump on the year before.

The financial hit to businesses is climbing too. The average self-reported cost per cybercrime report rose 50% to A$80,850. Small businesses averaged A$56,600. Medium businesses, A$97,200. Large organisations, A$202,700.

Healthcare isn't immune either. Australia recorded 1,113 notifiable data breaches in 2024, 25% more than in 2023. Health service providers accounted for the largest share at 20%.

While 99,000 people were caught up in our Manage My Health breach, over the Tasman, approximately 12.9 million Australians may have had their personal or health information exposed in the MediSecure incident in May 2024.

So no, Australia hasn't cracked cybersecurity. But it is further ahead in making cyber risk everyone's legal responsibility.

Australia has put more bite into its cybersecurity strategy

Australia laid out its ambition to become a world leader in cybersecurity by 2030 with the Cyber Security Strategy 2023 to 2030. It covers stronger cyber protections for businesses and individuals, safer technology, threat sharing, critical infrastructure protection, and building local cyber capabilities.

Then they backed it with law.

Australia's first dedicated Cyber Security Act became law in 2024. It brought in mandatory security standards for smart devices, ransomware payment reporting, protected information sharing during incidents, and a Cyber Incident Review Board to examine significant incidents.

Changes to critical infrastructure rules also raised the bar for what organisations must do to manage risk.

Some businesses now face specific reporting obligations when things go wrong. The ransomware reporting regime covers applicable critical infrastructure entities and businesses turning over more than A$3 million annually. If that's you, you must report ransomware payments within 72 hours of making one or becoming aware one's been made on your behalf. No exceptions.

The legislation doesn't promise breaches won't happen. Clearly, they still do. But it does mean organisations have to be more deliberate about how they prepare for and respond to cyber risk.

New Zealand's new strategy could start closing the gap

Here's the good news: New Zealand isn't standing still.

Our government released its Cyber Security Strategy 2026–2030 in February 2026. It's built around four objectives: understand, prevent and prepare, respond, and partner. A sensible framework.

But for Kiwi businesses, what comes next is probably the more important bit.

Alongside the strategy sits the 2026 to 2027 Action Plan. It looks at options for improving critical infrastructure cybersecurity, consults on possible regulation, proposes a single reporting point for cyber incidents, and floats civil financial penalties under the Privacy Act 2020. Sound familiar? It should. That's largely the playbook Australia has already been running.

For critical infrastructure specifically, the Government has named three intended outcomes: a clearer picture of threats and vulnerabilities, a minimum standard of cyber risk management, and more effective handling of threats to national security.

Government procurement is another space to watch. The Action Plan includes lifting and standardising security requirements in government digital procurement, and managing the public sector's use of high-risk vendors, services, and products.

The direction of travel is clear. Australian organisations are already adjusting to obligations that Kiwi businesses could soon face too.

Our recommendation? Don't wait for legislation to catch up

Here's where things stand.

Australia has dedicated cyber legislation covering ransomware reporting, connected device security, incident reviews, and critical infrastructure protections. New Zealand's new strategy flags several of the same areas, but many are still being developed, consulted on, or considered for reform.

New Zealand's Privacy Commissioner has been unusually blunt: the current Privacy Act doesn't give organisations enough incentive to understand or comply with even basic privacy requirements. Stronger penalties are on the table.

For Kiwi businesses, the choice is pretty straightforward.

Wait for the rules to tighten. Or get ahead of them now by treating cyber risk as a business risk. That means making sure how you protect information, manage your technology suppliers, and prepare for incidents is ready for a regulatory environment that is clearly on the move.

The numbers make a compelling case for not waiting. And the good news is, you don't have to figure it out alone.