In a busy fourth quarter of 2021 for cyber trolls, New Zealanders reported 3,977 cyber incidents, a 92% increase on the third quarter, according to CERT NZ.
Direct financial loss arose from 425 of these cases, totalling a whopping $6.6 million across all incident types. That's double the loss in the third quarter, and the highest quarterly loss since CERT NZ started capturing this data in 2017.
The majority ($5.9 million) went down the gurgler in the 'scams and fraud' category, the specific troll tricks and the amount Kiwis lost to them were:
- $2.3m lost to scams relating to buying, selling and donating goods online
- $1.8m lost to investment scams
- $1.1m lost to scams about a new job or business opportunity
- The remaining $0.7m was lost to other scams, not in those categories
The majority (76%) of the 3,977 incidents were reported directly to CERT NZ, but some came through other channels such as the Department of Internal Affairs, Police and the Commerce Commission.
"The increase in reports demonstrates that New Zealanders are becoming more aware and better skilled at recognising cyber security incidents.
“This also gives us a greater understanding of the extent and type of incidents that are occurring. We’re encouraged that both individuals and businesses are more willing to report, and we hope the messages about being cyber smart continue to spread," said Rob Pope, director of CERT NZ.
CERT (Computer Emergency Response Team) is a New Zealand Government organisation profiling cyber threats, while supporting and advising affected businesses and individuals.
It is also the central reporting point for online Covid-19 scams, misinformation and other mischief, providing details to the Ministry of Health and the Department of Prime Minister and Cabinet.
Besides financial loss, during the quarter CERT responded to incidents where other types of loss had occurred including reputational loss, data loss, technical damage (websites, email servers etc.) and operational impacts including time lost responding to issues.
Meanwhile, CERT NZ was still mopping up the fallout from the FluBot scam text campaign, which made up two thirds of the 1,707 malware incidents reported during the quarter.
Malware related incidents were up a staggering 1,030% compared to the third quarter total of 151, and the flu bot scam accounted for the increase as it was at its peak during the fourth quarter.
Well known for sending fake courier delivery messages, FluBot was an evolving beast that initially sent malware links which, when downloaded, blitzed the user's contacts with similar messages.
It later diversified into phishing with a link prompting users to enter their personal details and credit card information to have the 'parcel' released for a small fee of less than $5.
"If the recipient pays the fee, they are unknowingly signed up to a subscription that will charge them a higher amount (approximately $85) usually within three days," said CERT NZ.
Reports attributed to organisations, rather than individuals, made up just 5% of the total reports and were down from 15% from the previous quarter, with phishing and credential harvesting the most troublesome issues for business.
Phishing is when hackers trick someone into disclosing personal information, for example credit card details, on a site which may look legitimate. Credential harvesting is the unauthorised collection and use of usernames and passwords.
Another threat that remaining on CERT NZ's radar was the Log4j vulnerability, a security hole in an java-based software component used by many business, particularly in website management software. It was first made public in December.
An update to rectify the issue was provided but organisations remained vulnerable to data theft, unauthorised remote control or ransomware if they had delayed installing it.
"With so many software applications and services using Log4j, many companies still may not know it’s bundled together into the software they use," said CERT NZ.
CERT NZ, which released advice and guidance on Log4j, stated that no harm has yet been reported but recommended businesses contact software vendors to find out if they use Log4j and implement the fixes they provide, which would likely include updating to the latest version.
In a final piece of advice, Pope reminded the denizens of cyberspace to use strong passwords and not to trust any sites that seem too good to be true.
“Vigilance is the key word. We need New Zealanders to be aware that scammers are out there and to be careful with their personal information, especially around financial data.”
We welcome your comments below. If you are not already registered, please register to comment
Remember we welcome robust, respectful and insightful debate. We don't welcome abusive or defamatory comments and will de-register those repeatedly making such comments. Our current comment policy is here.