"NZSIS provided that assistance despite a lack of grounds for reasonable suspicion that any activity had occurred that was a matter of national security," she said.
"I have been unable to find that the Service showed the kind of caution I consider proper, for an intelligence agency in a free and democratic society, about launching any investigation into a journalist's sources."
She said an apology was owed to Hager.
In a statement, Director-General of Security Rebecca Kitteridge - the head of the SIS - said the agency was sorry.
"NZSIS has apologised to Mr Hager for these failings, any impact they had on him, and any distress that has been caused," she said.
"I reiterate that apology to Mr Hager publicly."
Hager said he wanted the SIS to introduce policies to stop them targeting media and journalists in the same way.
"I would rather get on with my work than fight these fights, but this issue needs to be fixed for the future," he said in a statement.
New Zealand Police last year also apologised to Hager and paid him "substantial damages" over an unlawful 2014 raid on his home, in which they tried to find a hacker behind the emails that formed the book Dirty Politics.