UPDATED 2.57PM: A specialist in cyber threats says it's highly likely the ransomware bug Wanna Cry is already in New Zealand, with ransom demands being reported in almost 100 countries so far.

The program demands 300 US dollars in digital currency to unlock a computer system, once it's infected.

The cyber attack struck at least 16 British National Health Service (NHS) organisations. There were reports of more than 75,000 similar attacks in 99 countries with Russia, Ukraine and Taiwan being the hardest hit, according to the cybersecurity firm Avast.

Andrew Colarik, a ‎Senior Lecturer in Security Studies at Massey University, said the malware originates from a tool used by the US National Security Agency, which was recently made public by Wikileaks.

"And as a result, all of our systems are the same as everybody else's - we're extremely exposed until these vulnerabilities are effectively closed."

He also said it was likely that although New Zealand wasn't a prime target, "it's just a matter of time" until Kiwi computers have the virus.

"After you cycle through the preferred targets you go to the secondary ones, and our ability to pay is equal to anybody in the world, so."

Dr Colarik says what we've seen so far is just the tip of the iceberg.

New Zealand's spy agency is "taking steps" to strengthen the cyber security of government departments.

The Government Communications Security Bureau says it has not received any reports of the "WannaCry" malware infection affecting computers in New Zealand.

But a spokesman for the GCSB said its specialist cyber arm - the National Cyber Security Centre - is working with a newly formed government taskforce, the National Computer Emergency Response Team, to protect New Zealand's interests.

"The NCSC is taking steps to help increase the resilience of New Zealand's nationally significant systems. These steps include technical measures and provision of mitigation advice."

According to the GCSB website, "nationally significant systems" include government departments, "key economic generators, niche exporters, research institutions and operators of critical national infrastructure".

The police have also briefed the Ministry of Health as a precaution.