The hack affected a small portion of the 825,000 e-mail accounts that New Zealand telecom giant Spark provided to users through its partnership with Yahoo, Privacy Commissioner John Edwards said in a statement.
He said the hack exemplified the international nature of privacy, with the US Federal Trade Commission and Irish Data Protection Commissioner already working together to make enquiries into the incident, Xinhua news agency reported.
"When agencies lose customer data, they need to help those customers take steps to protect themselves by alerting them as quickly as possible. This is particularly true with a breach of this size and with such sensitive information," said Edwards.
Proposed reforms to the country's Privacy Act, including mandatory breach notification, were due to be tabled in the New Zealand Parliament in 2017.
Last week, a Yahoo investigation confirmed that at least 500 million user accounts were hacked in late 2014 which, it believes, was a "state-sponsored" attack.
Based on the ongoing investigation, Yahoo believes that information associated with at least 500 million user accounts was stolen and the investigation has found no evidence that the state-sponsored actor is currently in Yahoo's network.
