Story image

Cyber threat spotlight: Kiwis report more, lose less in Q2

19 Sep 18

CERT NZ’s April-June 2018 Quarterly Report suggests that cyber threats – and the amount of people who are reporting them – are once again on the rise, and fewer people are losing money.

The report says that there were 736 incident reports in Q2, compared to 506 in Q1. While Kiwis lost $2.2 million from those incidents, it’s a 24% drop in just a single quarter, and 68% of incidents reporting money loss were for amounts lower than $500.

That doesn’t mean that New Zealanders should rest easy, as CERT NZ’s analysis of incident types found that phishing and credential harvesting is taking a toll on businesses and individuals. 

The number of phishing and credential harvesting reports skyrocketed from 196 in Q1 to 455 in Q2. Some of this can be attributed to CERT NZ’s close collaboration with the finance sector, which reported 74% of incidents.

The ever-persistent scam industry is still up to its old tricks – there were 104 reports of scam and fraud, of which most related to individuals. 

The report also found that those most likely to be impacted by direct financial loss are over 55 years of age, however those aged 35-44 also reported $77,300 in losses.

In addition, most reports about individuals came from those aged 65 and over (25%), while those aged 25-34 followed closely behind (21%).

Two incidents involved scam and fraud involved losses of $100,000 or more. They join two other incidents to make up 77% of all reported financial losses, totalling $1.7 million. The other two incidents of phishing and credential harvesting and unauthorised access.

While phishing and credential harvesting affected many organisations, vulnerabilities were also responsible for 69 incidents in organisations.

Those reported vulnerabilities include ones in websites or web servers (37 reports), authentication, authorisation and accounting (10 reports), networking (9 reports), and a number of others across software, applications, mobile devices, peripherals, and IoT devices.

“Of the 69 vulnerability reports received 1 January -30 June 2018, 54% related to website applications and servers, 14% to authentication, authorisation and accounting and 13% to networking,” the report says.

In one case a security researcher at ZX Security discovered vulnerabilities in cybersecurity products from global cybersecurity firm WatchGuard Technologies. WatchGuard, CERT NZ and the researcher worked together to analyse and verify the three vulnerabilities as part of a coordinated disclosure.

They released CVE identifiers as part of their findings and WatchGuard patched the vulnerabilities.

"By working together, potentially serious flaws in these products were able to be resolved in a timely and positive way, helping keep New Zealand businesses and organisations safe,” CERT NZ states.

Businesses and individuals can report cybersecurity incidents to CERT NZ. To do so, visit www.cert.govt.nz or call Freephone 0800 CERT NZ (0800 2378 69).

Report finds GCSB in compliance with NZ rights
The Inspector-General has given the GCSB its compliance tick of approval for the fourth year in a row.
Preparing for e-invoicing requirements
The New Zealand and Australian governments are working on a joint approach to create trans-Tasman standards to e-invoicing that’ll make it easier for businesses in both countries work with each other and across the globe
5c more per share: Trade Me bidding war heats up
Another bidder has entered the bidding arena as the potential sale of Trade Me kicks up a notch.
Hootsuite's five social trends marketers should take note of
These trends should keep marketers, customer experience leaders, social media professionals and executives awake at night.
Company-X celebrates ranking on Deloitte's Fast 500 Asia Pacific
Hamilton-based software firm Company-X has landed a spot on Deloitte Technology’s Fast 500 Asia Pacific 2018 ranking - for the second year in a row.
Entrepreneur reactivates business engagement in AU Super funds
10 million workers leave it up to employers to choose their Super fund for them – and the majority of employers are just as passive and unengaged at putting that fund to work.
Tether: The Kiwi startup fighting back against cold, damp homes
“Mould and mildew are the new asbestos. But unlike asbestos, detecting the presence – or conditions that encourage growth – of mould and mildew is nearly impossible."
Capitalising on exponential IT
"Exponential IT must be a way of life, not just an endpoint."