How to report a cyber incident to the NCSC in New Zealand

Who the NCSC is

The National Cyber Security Centre is part of the Government Communications Security Bureau. For many years CERT NZ was the place small businesses and individuals reported incidents, while the NCSC focused on nationally significant organisations. The two have since been brought together, and the NCSC is now the single government point of contact for cyber security reports and guidance. Older articles and posters may still mention CERT NZ, and its familiar guidance continues under the NCSC. The NCSC publishes alerts about active threats, practical guides for businesses and individuals, and advice on specific vulnerabilities. Subscribing to its alerts is a simple way to hear about urgent issues affecting products you use.

Why reporting is worth the time

Many businesses do not report because they feel embarrassed or assume nothing will happen. In practice, reporting brings real benefits. The NCSC can tell you whether the same attack has been seen elsewhere, suggest steps to contain it and point you to the right agencies. For some threats it may know of decryption tools or indicators to look for in your systems. Your report also adds to the national picture. When several businesses report the same fake invoice scam or the same exploited firewall flaw, the NCSC can issue warnings, work with providers to take down malicious sites and help others avoid becoming the next victim.

What to report

Report anything that has caused or could cause harm: ransomware, unauthorised access to email or systems, data breaches, malware infections, denial of service attacks, scam emails or calls that tricked someone, fraudulent payments, and vulnerabilities you have discovered. Even attempts that failed are useful, especially if they were targeted or convincing.

If you are unsure whether something is worth reporting, report it. A scam that fooled one person in your office has probably been sent to many others, and an early report can help stop the next one. Small details, such as the sender's address or the wording of a fake invoice, often turn out to be the pieces that link separate reports together. The NCSC would rather receive a minor report than miss an early sign of a broader campaign.

How to report and what to include

Reports are made online through the NCSC website, which has a form designed for businesses and individuals. Check the site for current contact options, including any phone line for urgent incidents. Have the key facts ready: what happened, when you noticed, which systems or accounts are affected, what you have done so far, and any evidence such as the email, sender address, website addresses or ransom note. Keep the original evidence. Forwarding a suspicious email as an attachment preserves its technical headers, which are more useful than a screenshot. Note the times things happened in New Zealand time, and keep a copy of your report and any reference number you receive.

Other people you may need to tell

Reporting to the NCSC does not cover your other obligations. If money has been sent to a fraudster, call your bank immediately; recovery chances drop quickly. If a crime has been committed, report it to Police as well, particularly for fraud or extortion. If personal information was involved and serious harm is likely, you must notify the Privacy Commissioner and affected people under the Privacy Act 2020. If you have cyber insurance, notify your insurer promptly, as most policies require early notification and may specify who leads the response. Some regulated industries, such as financial services, have additional reporting duties to their own regulators.

What happens after you report

The NCSC reviews reports and contacts reporters where it can help, which may include follow-up questions or guidance. It does not take over your incident or act as your IT provider, so you will still need your own technical support to investigate and recover. Information you share is handled confidentially and used to protect others; the NCSC is not a regulator looking to penalise businesses that report. Over time, the alerts and advisories built from reports find their way back to businesses like yours, which is a good reason to subscribe and act on them.

Building reporting into your plan

Add the NCSC reporting link to your incident response plan and your offline contact sheet, alongside your bank, insurer and IT provider. Decide who in the business makes the report, usually the incident lead or IT provider, so it does not fall through the cracks during a busy recovery. Encourage staff to report scam attempts internally too. A shared mailbox or a simple report button in Outlook lets IT see patterns, and the most convincing examples can be passed on to the NCSC.