New Zealand cyber incidents needing specialist support rise

New Zealand's National Cyber Security Centre handled 1,129 cyber security incident reports in the second quarter, with more cases requiring specialist technical support.

Between April and June, 92 incidents were triaged for specialist assistance because of their potential national significance, up from 77 in the previous quarter. The remaining 1,037 reports did not require that level of support.

Deputy Director-General Catriona Robinson said the figures pointed to a shift in the nature of incidents rather than a rise in overall reporting volumes. The total number of reports was slightly below the 1,164 recorded in the first quarter.

"New Zealanders continue to report cyber security incidents at a consistent rate, which helps us build a stronger understanding of the threats affecting individuals, businesses and organisations across the country. While the total number of reports has remained relatively stable, we are seeing an increase in incidents that require specialist technical support because of their potential national impact. We encourage New Zealanders to take action to prevent cyber security attacks as the impacts can be very damaging," Robinson said.

Losses fall

Reported direct financial losses reached NZD $2.7 million in the quarter, down 52 per cent from NZD $5.6 million in the first three months of the year. Even so, a small number of larger incidents accounted for most of the damage.

Incidents involving losses of NZD $10,000 or more accounted for about NZD $2.4 million, or 91 per cent of all reported losses, despite representing just 49 cases. The heaviest financial harm therefore continued to come from a limited number of higher-value incidents.

Scams and fraud were the most frequently reported category, with 348 incidents and about NZD $860,000 in financial losses.

Phishing and credential harvesting were the second most common category. Although no separate loss figure was disclosed for that group, unauthorised access incidents, while less common, led to about NZD $1.3 million in losses, or roughly half the total reported in the quarter.

Shifting tactics

The NCSC also reported an increase in malware scam cases. In these incidents, criminals use deceptive methods to persuade victims to install malicious software that can steal personal or sensitive information.

The centre's latest cyber security insights material includes guidance on malware and QR code phishing scams. One article explains how malware works and outlines examples of malware-related incidents affecting people in New Zealand. Another examines QR code phishing, in which fraudulent codes are used to trick people into handing over information or compromising their devices.

QR code scams have drawn wider public attention after incidents linked to parking meters in Christchurch. The example formed part of a broader warning that common consumer-facing fraud methods are continuing to evolve.

The latest quarterly figures suggest the cyber threat picture is defined not only by the number of reports received. The increase in incidents assessed as having possible national impact points to greater complexity in part of the caseload, even as total reports remain broadly steady.

That trend matters for businesses, public sector organisations and individuals alike because cases requiring specialist intervention are more likely to involve broader operational or systemic risks. At the same time, the loss data shows that everyday fraud and access-related attacks continue to impose direct costs on victims.

The quarter's figures also underline how uneven the financial damage from cyber incidents can be. While hundreds of cases were reported, most losses were concentrated in a relatively small subset of higher-value incidents, suggesting that a limited number of successful attacks can have an outsized economic effect.

For the NCSC, the figures point to two parallel challenges: maintaining public reporting of common scams and fraud while responding to a larger share of cases serious enough to warrant specialist technical support. The rise in those more serious incidents came despite a modest fall in total reports from the previous quarter.