While the group had listed some details of the incident, McKay obtained an injunction from the High Court of Auckland restricting any disclosure of the data impacted by the attack.

McKay told Cyber Daily it became aware of the initial unauthorised access in January, impacting “one internal device”.

“We immediately initiated our cyber security response plan while the unauthorised access was isolated and contained. Our IT systems have continued to operate securely throughout this period. This has been independently reviewed and verified by a third-party cyber security specialist,” a McKay spokesperson said.

“All customers and relevant individuals involved were notified and received updates as our investigation continued. The incident was also reported to the appropriate authorities, including the Office of the Privacy Commissioner and the National Cyber Security Centre.”

McKay is just one of three organisations listed so far by Mnt6, which only emerged at the end of April 2026. The group’s other two victims are both Canadian firms.

The group says little about its operations on its leak site, and while little is known about Mnt6’s origins, cyber security firm WatchGuard believes it operates as a data broker.

Who is McKay

Headquartered in the North Island city of Whangarei, McKay has offices in nine locations around New Zealand.

The firm provides design, engineering, construction, and maintenance services across infrastructure, renewables, and marine sectors.

Some of its recent projects include providing street lighting in Wellington and Queenstown, the Waikato District-wide Kingfisher Project, and the Lightyears Solar Farm.