Under the spotlight: CERT NZ reveals last year’s most pervasive cyber threats

New Zealanders from 'all walks of life' reported 1131 cybersecurity issues ranging from cryptocurrency scams to phishing in 2017, resulting in more than $5.3 million in losses.

CERT NZ is New Zealand's national computer emergency response team. It launched in April 2017 and since then it has released quarterly reports that analyse what threats are affecting Kiwis.

From CERT NZ's Q4 report, people reported $3.4 million in losses – a large chunk of the $5.3 million total over 2017.

While that $5.3 million loss figure may be daunting, it is not clear how much of the losses were recovered. There were nine incidents that involved losses of more than $100,000 each.

Other loss factors including data loss, operational impacts, reputational loss and technical damage.

"Cyber criminals are indiscriminate in their targeting and anyone online can be affected," comments CERT NZ director, Rob Pope.

In Q4, 377 incidents were reported to CERT NZ, of which 144 involved cybercrime and were referred to the police.

139 incidents involved scams and fraud; 126 involved phishing and credential harvesting; 36 involved successful unauthorised access; and 29 involved malware.

The report notes that there was a notable uptick of cryptocurrency scams.

In Q4, 6% of reports involved cryptocurrency and the total financial loss was $262,323 – 8% of the total losses last quarter.

In one case study, a cryptocurrency investor reported a Bitcoin theft after falling for what appeared to be a phishing scam. CERT NZ says it's unlike the investor will be able to recover the missing Bitcoin.

"Some of these scams are variations on existing ones, using simple phishing techniques to trick users into giving scammers their passwords and thereby access to their digital wallets. Others are more sophisticated, adapting cybercrime techniques to commit theft. Tracing and recovering stolen cryptocurrencies is very difficult due to the nature of the technology," the report says.

There were also new twists on various other scams, including fake tech support scams, and fake investment websites.

Tech support scammers have cost Kiwis more than $90,000 in Q4. Scammers set up fake tech support websites and are now taking advantage of known brand names including Google, Xero, Samsung, and Dell.

"They rely on users searching for a genuine product support website and instead finding the scammer's fake support site. Users are typically asked to pay a fee to receive support, but no help is provided and the unlucky users are left out of pocket," the report explains.

CERT NZ combined data from Q2, Q3 and Q4 2017 to provide a regional breakdown of where most threats were reported.

Overall, Wellington incident reports accounted for 230 of the 812 reports; followed by Auckland (221), Canterbury (62) and the Waikato (35). 106 reports did not provide a location.

"We use data to help New Zealanders stay safe from cyber security threats and we need people to lodge a report with CERT NZ to help us build a more detailed picture of the issues Kiwis are facing in their online lives. Anyone can report a cyber security incident to CERT NZ and get help to recover. Receiving these reports also means we can proactively help other New Zealanders who may be affected by the same issue," Pope concludes.

If you or your organisation experiences a cyber security threat – or if you suspect you may have been exposed to one – contact CERT NZ any time at www.cert.govt.nz or call 0800 CERT NZ, Monday to Friday, 7am – 7pm.