The Deputy Prime Minister is warning that "malicious actors" are exploiting Kiwis' private information after his daughter was targeted and tracked by a firm with ties to China's military.
The families of Winston Peters and other senior politicians — including Prime Minister Jacinda Ardern — have also been in the Chinese big data company's sights.
The sister and parents of Ardern have had profiles built on a secret Chinese database, along with the mother of former trade minister Todd McClay and one of ex-Prime Minister Sir John Key's children.
University of Canterbury professor Anne-Marie Brady, a specialist in China, said the revelations showed a concerted influence campaign from China targeted at political and business elites.
"Our New Zealand politicians are being targeted on a grand scale, and in minutiae,'' she said.
A spokesperson for the prime minister said she was unwilling to comment. "Activity of this nature does occur,'' the spokesperson said.
Peters said: "There are malicious actors out there seeking to profit from trafficking private information and people need to protect themselves."
Key did not provide a comment.
The revelations come from a large-scale leak from the Shenzhen-based big data company Zhenhua Data, which reportedly works with China's state security and intelligence service, the Ministry of State Security.
More than 250,000 listings in the company's 2.4 million-strong Overseas Key Information Database (OKIDB) — apparently built with open-source information — were leaked to Chris Balding, a US academic, who had worked in China until 2018, and extracted by Australian cybersecurity expert Rob Potter.
The listings include town of residence, links to social-media accounts and notes indicating a particular interest in job titles or criminal convictions for tax or trafficking offences.
The leaked information was provided to a consortium of international journalists, and the findings have caused a storm of controversy in Australia, the US and the United Kingdom.
The OKIDB appears to have been more than a decade in the making and includes figures, and their family members, whose influence has long-waned. The wife of disgraced Christian Heritage leader Graham Capill is profiled, but her husband's political influence was extinguished when he was jailed for child-sex offences in 2005.
Request for comment to Zhenhua went unanswered.
The photo linked to the entry of Key's son, a media picture of him in his early teens playing baseball, suggest he became a target for data collection early in his father's first term as prime minister.
The latest entries on the leaked database appear to cease in early 2018.
Patterns seen in overseas analysis of the OKIDB leaks as a map of networks of interest — capturing influential figures in politics, business, technology, the judiciary, military and race relations, and their immediate family members — are reflected in the New Zealand listings.
Particular interest seems to have been paid to prominent executives in telecommunications, biotechnology and venture capital firms, along with foreign-affairs diplomatic staff focused on China.
Brady said while the information on the OKIDB appeared largely open-source, the selection of people of interest was telling.
"There are a few defence officials, and our former and present ambassadors to China. But there's also the head of the China desk at Mfat," she said.
"Data scraping is bound to happen, but somebody knows our society, and our government agencies, quite intimately. You can only know who the current China desk person is if you're interacting with them as a diplomat — or you're on the inside."
Intelligence commentator Paul Buchanan said the OKIDB sourcing of large quantities of social media and other public data appeared to operate in a similar fashion to Palantir, which contracted to Five Eyes alliance governments including New Zealand.
Buchanan said the particular interest in family members and relatives — not typically of interest to Western intelligence agencies — likely stemmed from an attempt to build network maps and "identify vulnerabilities".
"When you start looking at families, they're looking for vulnerabilities, and they're looking for blackmail. You may never use it, but if you do enough network analysis you could find a high court judge, for instance, who could be leveraged," he said.
At least three judges have profiles on the OKIDB.
Zhenhua's website has described its mission as being to "integrate global open-source data intelligence to help the great rejuvenation of the Chinese nation!"
After stories about the leak were published, the material was pulled from the site.
- Additional reporting by Keith Ng