Cyber security threats in New Zealand show worrying rise

New Zealand is experiencing a growing array of cyber security threats emanating from both criminal enterprises and state actors, a new report by the Government Communications Security Bureau (GCSB) highlights.

The annual Cyber Threat Report from the National Cyber Security Centre (NCSC), a part of the GCSB, has revealed a landscape that is becoming increasingly tumultuous, with cyber threats expected to escalate in breadth as the reliance on technology deepens.

Lisa Fong, GCSB's Deputy Director-General of Cyber Security, said, "The National Cyber Security Centre's (NCSC) annual Cyber Threat Report shows our cyber threat landscape is constantly changing, with malicious cyber activity likely to continue to impact a larger range of systems and victims as our technology use increases."

The report covers the period leading up to 30 June 2024 and marks the NCSC's inaugural year as the lead operational cyber security agency for New Zealand. During this period, the NCSC logged a total of 7,122 cyber security incidents. "This is the first reporting year since CERT NZ was transferred to the NCSC, enabling an overview of cyber threats to be presented in a single report," Ms Fong stated.

The consolidation of data allows for a more comprehensive understanding of the cyber threat situation facing the nation, according to the report. "While the report draws from separate data sets, we can begin to see the extent of malicious cyber activity. Of the 7122 incidents, 6779 were handled through the NCSC's general triage process, often affecting individuals or small to medium businesses, resulting in $21.6 million of reported losses," Ms Fong added.

A subset of 343 incidents was identified for their potential national significance, requiring more specialised technical intervention. These particular instances "affect the systems and data of organisations in key sectors or where NCSC's understanding of the malicious actor responsible for the incident means there is additional risk," she explained.

There was a slight increase in such significant events from the previous year, with 343 incidents compared to 316 in 2022/23. Of these current significant incidents, 110 are attributed to state-sponsored actors, while 65 are presumably initiated by criminal or financially motivated entities, maintaining a consistent trend observed in prior reports.

Ms Fong encouraged the public and businesses to "familiarise themselves with the cyber landscape, develop a better understanding of the techniques and tactics used by malicious cyber actors, and take the steps recommended in this report to mitigate them." This advice aims to prepare stakeholders to better defend against emerging threats and reduce vulnerability to cyber attacks.