New Zealand Contractor McKay Confirms January Cyberattack
Summary
McKay confirmed unauthorized access to one internal device in January. The New Zealand contractor says it contained the access, notified affected people and authorities, and is strengthening security; Mnt6 later listed the firm on its leak site.
Key points
- McKay said it became aware of unauthorized access in January, affecting one internal device.
- Mnt6 listed McKay on its leak site on 30 April; the group emerged at the end of April 2026.
- McKay said it isolated and contained the access, and that its systems continued operating securely; a third-party cybersecurity specialist reviewed this.
- The company said it notified customers and relevant individuals and reported the incident to New Zealand’s Office of the Privacy Commissioner and National Cyber Security Centre.
- McKay said it is working with specialists to strengthen network security and is monitoring for further suspicious activity.
- An Auckland High Court injunction restricts disclosure of data affected by the attack.
Article Details
- Victim Organization
- McKay
- Incident Type
- Unauthorized access affecting one internal device; McKay confirmed it was the victim of a cyber attack.
- Operational Impact
- McKay said its systems continued to operate securely and that the incident was independently reviewed and verified by a third-party cybersecurity specialist. It notified affected customers and relevant individuals and reported the incident to authorities.
- Ransom Or Extortion
- Mnt6 listed McKay on its darknet leak site and reportedly posted incident details. McKay obtained an injunction restricting disclosure of information about affected data. No ransom demand or data theft is confirmed in the article.
- Claim Status
- confirmed