Fisher & Paykel Healthcare has disclosed that unauthorised parties accessed a subset of company files and two employee email accounts, the NZX-listed medical device manufacturer said on Thursday.
Some of the compromised files contained personally identifiable information. The company said it is notifying affected individuals and has informed the relevant authorities.
“There is no evidence that the unlawful activity compromised the company’s system that maintains patient data,” Fisher & Paykel said in its NZX announcement.
The company, which produces devices used to treat obstructive sleep apnoea, said there has been no impact on its products, manufacturing operations, or supply chain. It believes the incident is contained, with no evidence of ransomware or malware, and expects no material financial impact.
Shares in Fisher & Paykel fell as much as 1.5% to $48.68 during the session following the disclosure.
The breach is the latest in a string of cyber incidents affecting New Zealand organisations. It arrives as the gap between the country’s rising threat level and its soft cyber insurance market continues to widen.
The National Cyber Security Centre (NCSC) handled 369 incidents of potential national significance in 2025/26, with 162 linked to criminal or financially motivated actors, an 18% rise on the prior year, according to the NCSC’s Cyber Threat Report 2026. Four incidents were classified C2 (highly significant), the first time that severity level had been reached in five years.
NCSC head Catriona Robinson said: “The severity of incidents has increased.”
Yet Aon rated New Zealand’s cyber insurance market as soft in Q1 2026, with abundant capacity and broader coverage available. That combination of escalating threats and easing premiums creates a window for brokers to revisit cyber programmes with clients who may not have tested their cover against a real-world scenario.
Read more: NZ cyber threat rises as insurance market moves the other way
Fisher & Paykel’s disclosure follows a series of breaches across New Zealand’s health sector.
In December 2025, attackers used stolen credentials to breach Manage My Health, the country’s largest patient health portal, exposing health records of nearly 100,000 New Zealanders. The Office of the Privacy Commissioner (OPC) issued compliance notices to both Manage My Health and Health NZ in September 2026, finding that multi-factor authentication had been available but not mandatory at the time of the attack.
Privacy Commissioner Michael Webster said that “health information by its nature is sensitive personal information.” He also noted that the Privacy Act 2020 “does not provide sufficient incentives for many organisations” to invest in adequate safeguards.
The Act requires organisations to notify the Commissioner of breaches that cause or are likely to cause serious harm, but financial penalties remain limited. Fines of up to $10,000 apply only to a narrow set of procedural offences, according to the Office of the Privacy Commissioner. There is no civil penalty for breaching the information privacy principles themselves.
Privacy breach notifications to the Commissioner increased 26.5% between FY 2023/24 and FY 2024/25, while serious harm notifications rose 43% over the same period, according to the Commissioner’s quarterly report to the Minister of Justice.
Read more: Privacy Commissioner splits cyber responsibility between two organisations
Multi-factor authentication has become a baseline underwriting requirement. NSP cyber CISO Geordie Stewart told Insurance Brokers Association of New Zealand (IBANZ) members in April 2026 that without MFA, obtaining cover would be “very difficult.” Insurers now expect MFA across email, remote access, VPN, and administrator accounts, and verify it at claims time.
Third-party and supply-chain exposure is another area to test. In May 2026, a supply-chain attack on the Canvas learning platform affected more than 30 New Zealand tertiary institutions and schools, compromising data on an estimated 110,000 to 120,000 students and staff, according to the Ministry of Education. Brokers should check whether clients’ policies respond to losses triggered by a vendor breach, not only a direct attack.
New Zealand’s proposed critical infrastructure cyber security rules, which closed for consultation in April 2026, include mandatory 72-hour incident reporting and penalties of up to $5 million or 2% of annual turnover for entities, and up to $500,000 for individual directors. Aon New Zealand cyber practice leader Duncan Morrison said that “our regulators are nowhere near as punitive as the likes of Australia,” but the direction of travel is clear.
Fisher & Paykel’s statement that it expects no material financial impact may limit immediate claims activity. But the broader pattern of escalating incidents, regulatory reform, and tightening underwriting standards means the conversation with clients should not wait for the next breach.
