New Zealand has reported a Chinese government-backed cyber attack on its parliament and MPs, the first time Kiwi intelligence agencies have attributed to Beijing an effort to compromise its democratic institutions.
However, unlike similar attacks made public by the UK and US overnight, the government has no plans to retaliate beyond disclosing the incident.
Prime Minister Chris Luxon said airing the issue publicly was a first for New Zealand and "a very big first step".
"We're calling out where we see malicious cyber activity from any state that attacks our democratic institutions," he said.
On Tuesday morning Judith Collins, the minister responsible for New Zealand's intelligence agencies, revealed an August 2021 attack by APT40, a cyber-espionage outfit based in China's Hainan province.
The group targeted the parliament's law writers - the counsel office - and the parliamentary service, including MPs.
Intelligence agency Government Communications Security Bureau (GCSB) director general Andrew Clark said APT40 retrieved some data in the attack but not "sensitive or strategic" information.
"Analysis of the tactics and techniques used by the actor enabled us to confidently link the actor to (China) ... reinforced by analysis from international partners of similar events in their own jurisdictions," he said.
Mr Clark said Kiwi officials identified and subdued the threat promptly.
China's ambassador to New Zealand, Wang Xiaolong, said he "rejected outright the groundless and irresponsible accusations" made.
"When investigating and determining the nature of cyber cases, one needs to have adequate and objective evidence, instead of smearing other countries when facts do not exist," he said.
The public airing of the New Zealand incident follows similar reports by the UK and US governments earlier on Tuesday (AEDT).
Officials in those countries allege deeper reconnaissance and cyber attacks on government institutions by China-backed agents, alleging MPs, academics and journalists critical of China were also targeted.
The UK and US governments have filed charges and imposed sanctions on individuals and businesses involved.
Mr Luxon said New Zealand would not do similarly or escalate the matter beyond making the incident public.
"Putting sunlight on it and calling it out is actually a very good thing," he said.
Instead, New Zealand's formal objections were registered by foreign affairs department officials over the phone to China's ambassador in Wellington.
Mr Luxon said it did not change how his government would interact with China, nor would it derail trips by the trade minister, the foreign minister and himself in the coming months.
"We've been very clear-eyed about our approach in managing the relationship with China," Mr Luxon said.
"We've got a long standing complex relationship with China.
"We collaborate and cooperate where we can on issues around trade and on climate, but obviously we also have differences and we call those out consistently.
"We have a very constructive relationship about developing trade on a range of other issues and we'll continue to do that."
Ms Collins said despite the attack, China remained "a very good friend".
"It is totally unacceptable ... our democratic institutions are absolutely sacrosanct to us and we are going to do whatever we can," she said.
Foreign Minister Winston Peters also labelled it unacceptable, though neither he nor the prime minister raised the issue with Chinese Foreign Minister Wang Yi on his official visit last week.
Former prime minister Chris Hipkins, who met President Xi Jinping in 2023, also chose not to raise the matter when he travelled to Beijing.
"We raised a range of uncomfortable issues (but) there will always be more things you can raise," he said.
Australia and New Zealand ministers also issued condemnations of China for its cyber attacks aimed at the UK, which appear to be the most serious aired in the past 24 hours.
"This behaviour is unacceptable and must stop," Australian Foreign Minister Penny Wong said.
