CERT NZ: Email extortion & scams hit Kiwis hard in the pocket

Despite ongoing efforts to raise awareness about online scams and fraud, New Zealanders are still losing staggering amounts of money.

CERT NZ's Q4 2018 Quarterly Report puts the total amount lost to cybersecurity issues at $14 million in 2018, of which more than $8 million was lost to scams and fraud.

In the last quarter alone (October-December), CERT NZ received 1333 reports about cybersecurity issues. New Zealanders also lost $4.9 million due to scams and fraud.

"These scams are becoming increasingly professional, they generate a considerable amount of money so scammers evolve their approach and employ new methods to continue tricking people into paying up," explains CERT NZ director Rob Pope.

Email extortion scams – in which scammers send threatening emails that trick people into paying money to make the problem disappear – accounted for 36% of all scam reports.

"We saw this type of scam evolve rapidly, from webcam blackmail emails that contained personal information like passwords in October, through to bomb threat emails in December. It's more important than ever that Kiwis have a trusted source they can turn to for actionable advice to protect themselves online," says Pope.

The bomb threat emails in December were concerning for many New Zealand businesses. The emails threatened to detonate a bomb in the company's building if the business did not make payment. CERT NZ and many international partners issued an advisory about the hoax.

Beyond email extortion scams, the report also highlights a significant number of phishing and credential harvesting reports (431), followed by 48 malware reports – more than double the number in Q3.

In one case study, the report tells the story of one New Zealand business with 20 regional offices that caught a malware infection. The malware was delivered by a phishing email that appeared to be from an accounting service.

A company employee clicked the link and unwittingly downloaded malware in the background. The malware is able to display a phony online banking page, which captured the employee's login and two-factor authentication information.

The attackers access the company's bank account from an overseas IP address, and it was only then that the bank noticed something was amiss. The bank notified the company.

"The business was concerned that removing the malware from their systems would impact their day-to-day operations. CERT NZ helped the business resolve the incident while maintaining their operations," the report says.

CERT NZ also issued an advisory to share information about the threat.

"It's CERT NZ's job to help New Zealanders report the cyber security incidents they are impacted by and get the information they need to recover. These reports also allow us to aggregate our information alongside international sources to make sure New Zealanders have access to the most up-to-date information on cyber security threats," says Pope.

If you or your organisation experience a cybersecurity threat – or if you suspect you may have been exposed to one – contact CERT NZ any time at www.cert.govt.nz or call 0800 CERT NZ, Monday to Friday, 7am – 7pm.