Story image

CERT NZ: Email extortion & scams hit Kiwis hard in the pocket

12 Mar 2019

Despite ongoing efforts to raise awareness about online scams and fraud, New Zealanders are still losing staggering amounts of money.

CERT NZ’s Q4 2018 Quarterly Report puts the total amount lost to cybersecurity issues at $14 million in 2018, of which more than $8 million was lost to scams and fraud.

In the last quarter alone (October-December), CERT NZ received 1333 reports about cybersecurity issues. New Zealanders also lost $4.9 million due to scams and fraud.

“These scams are becoming increasingly professional, they generate a considerable amount of money so scammers evolve their approach and employ new methods to continue tricking people into paying up,” explains CERT NZ director Rob Pope.

Email extortion scams – in which scammers send threatening emails that trick people into paying money to make the problem disappear – accounted for 36% of all scam reports.

“We saw this type of scam evolve rapidly, from webcam blackmail emails that contained personal information like passwords in October, through to bomb threat emails in December. It’s more important than ever that Kiwis have a trusted source they can turn to for actionable advice to protect themselves online,” says Pope.

The bomb threat emails in December were concerning for many New Zealand businesses. The emails threatened to detonate a bomb in the company’s building if the business did not make payment. CERT NZ and many international partners issued an advisory about the hoax. 

Beyond email extortion scams, the report also highlights a significant number of phishing and credential harvesting reports (431), followed by 48 malware reports – more than double the number in Q3.

In one case study, the report tells the story of one New Zealand business with 20 regional offices that caught a malware infection. The malware was delivered by a phishing email that appeared to be from an accounting service.

A company employee clicked the link and unwittingly downloaded malware in the background. The malware is able to display a phony online banking page, which captured the employee’s login and two-factor authentication information.

The attackers access the company’s bank account from an overseas IP address, and it was only then that the bank noticed something was amiss. The bank notified the company.

“The business was concerned that removing the malware from their systems would impact their day-to-day operations. CERT NZ helped the business resolve the incident while maintaining their operations,” the report says.

CERT NZ also issued an advisory to share information about the threat.

“It’s CERT NZ’s job to help New Zealanders report the cyber security incidents they are impacted by and get the information they need to recover. These reports also allow us to aggregate our information alongside international sources to make sure New Zealanders have access to the most up-to-date information on cyber security threats,” says Pope.

If you or your organisation experience a cybersecurity threat – or if you suspect you may have been exposed to one – contact CERT NZ any time at www.cert.govt.nz or call 0800 CERT NZ, Monday to Friday, 7am – 7pm.

Fake apps on Google Play scamming users out of cryptocurrency
Fake cryptocurrency apps on Google Play have been discovered to be phishing and scamming users out of cryptocurrency, according to a new report from ESET.
Optic Security Group celebrates Axis accolade
Auckland-based business security systems provider Fortlock has picked up an award at Axis Communications’ annual Oceania Axis Partner Summit 2019.
Managing data to comply with privacy regulations - Micro Focus
It’s crucial for organisations to be able to access, understand, and accurately classify the data they have so they know how to treat it.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.
Forrester names Trend Micro Leader in email security
TrendMicro earned the highest score for technology leadership, deployment options and cloud integration.
LogRhythm releases cloud-based SIEM solution
LogRhythm Cloud provides the same feature set and user experience as its on-prem experience.
The impact of bringing biometrics to the door
"Despite the benefits of biometrics, there have been impediments to its broader enterprise adoption."