The Reserve Bank of New Zealand - Te Pūtea Matua says it is responding "with urgency" to a breach of one of its data systems.
In a statement, the bank said a third-party file sharing service it used to share and store some sensitive information had been illegally accessed.
Governor Adrian Orr said the breach had been contained, the bank was acting with urgency and treating the matter with the highest priority.
"We are working closely with domestic and international cyber security experts and other relevant authorities as part of our investigation and response to this malicious attack," he said.
"The nature and extent of information that has been potentially accessed is still being determined, but it may include some commercially and personally sensitive information."
Orr said the system had been secured and taken offline until the bank had completed initial investigations.
"It will take time to understand the full implications of this breach, and we are working with system users whose information may have been accessed. Our core functions remain sound and operational."