Director of public health Dr Caroline McElnay said the genomic sequencing between the first case in the cluster, Case A, and the woman, Case D, was "identical".
It indicated a "straight transmission" between the two parties, she said.
Three close contacts of the woman - two friends and a work colleague - have tested negative for the virus.
However, health authorities are still trying to work out how the virus was transferred from Defence Force workers to the woman.
The two NZDF staff were in the Auckland CBD last week, and spent two hours at a bar 100 metres away from the woman's work, A-Z Collections, on High St.
But CCTV footage has not yet found any interaction between the two parties.
"We don't have a confirmed theory for how the virus was transmitted between the cases that we are currently dealing with," Hipkins said.
"And we are not in a position at this stage to completely rule out any other as yet identified cases flowing from that."
For that reason, testing was being ramped up over the weekend. And masks would become mandatory on public transport in Auckland and domestic flights from Monday.
The latest positive case, an AUT student, tested positive yesterday. She first showed symptoms on Monday and was tested on Tuesday.
The Ministry of Health said she told her boss at her retail job she had been tested but was told by her manager to come to work on Thursday while wearing a mask. The manager disputed this, saying the woman never told them she was sick.
The cluster, formally known as the November quarantine cluster, now numbers four people.
It began when a Defence Force worker at the Jet Park quarantine facility tested positive last Friday (Case A). He is believed to have picked it up at the facility, but the exact source is not known.
The worker met another Defence Force worker (Case B) in Auckland last Wednesday. That person then flew to Wellington the following day, and did not wear a mask on the flight.
He developed symptoms on Friday night and he was tested on Saturday. A positive result came back on Sunday.
The person ate at Malaysian restaurant Little Penang on the Terrace last Thursday. Another Defence Force worker (Case C) at the lunch has also contracted the virus.
Close contacts on the flight, the airport, the restaurant and other places the workers had been have been tested and there have been no further positive cases.
And as of this morning, 173 people have been tested from the woman's apartment block, with 101 negative results so far.