Story image

CERT NZ: Email extortion & scams hit Kiwis hard in the pocket

12 Mar 2019

Despite ongoing efforts to raise awareness about online scams and fraud, New Zealanders are still losing staggering amounts of money.

CERT NZ’s Q4 2018 Quarterly Report puts the total amount lost to cybersecurity issues at $14 million in 2018, of which more than $8 million was lost to scams and fraud.

In the last quarter alone (October-December), CERT NZ received 1333 reports about cybersecurity issues. New Zealanders also lost $4.9 million due to scams and fraud.

“These scams are becoming increasingly professional, they generate a considerable amount of money so scammers evolve their approach and employ new methods to continue tricking people into paying up,” explains CERT NZ director Rob Pope.

Email extortion scams – in which scammers send threatening emails that trick people into paying money to make the problem disappear – accounted for 36% of all scam reports.

“We saw this type of scam evolve rapidly, from webcam blackmail emails that contained personal information like passwords in October, through to bomb threat emails in December. It’s more important than ever that Kiwis have a trusted source they can turn to for actionable advice to protect themselves online,” says Pope.

The bomb threat emails in December were concerning for many New Zealand businesses. The emails threatened to detonate a bomb in the company’s building if the business did not make payment. CERT NZ and many international partners issued an advisory about the hoax. 

Beyond email extortion scams, the report also highlights a significant number of phishing and credential harvesting reports (431), followed by 48 malware reports – more than double the number in Q3.

In one case study, the report tells the story of one New Zealand business with 20 regional offices that caught a malware infection. The malware was delivered by a phishing email that appeared to be from an accounting service.

A company employee clicked the link and unwittingly downloaded malware in the background. The malware is able to display a phony online banking page, which captured the employee’s login and two-factor authentication information.

The attackers access the company’s bank account from an overseas IP address, and it was only then that the bank noticed something was amiss. The bank notified the company.

“The business was concerned that removing the malware from their systems would impact their day-to-day operations. CERT NZ helped the business resolve the incident while maintaining their operations,” the report says.

CERT NZ also issued an advisory to share information about the threat.

“It’s CERT NZ’s job to help New Zealanders report the cyber security incidents they are impacted by and get the information they need to recover. These reports also allow us to aggregate our information alongside international sources to make sure New Zealanders have access to the most up-to-date information on cyber security threats,” says Pope.

If you or your organisation experience a cybersecurity threat – or if you suspect you may have been exposed to one – contact CERT NZ any time at www.cert.govt.nz or call 0800 CERT NZ, Monday to Friday, 7am – 7pm.

Bitglass appoints new cloud, business development leaders
The cloud security company has appointed vice presidents for worldwide channels and worldwide business development.
Ping Identity offerings accelerates cloud MFA and SSO adoption
90% of respondents trust MFA as an effective security control to protect identity data in public clouds, yet only 60% of organisations have formally adopted it.
Cloud innovation driving NZ IT services market, says IDC
Managed services makes up the largest portion of total IT services revenue. However, the project-oriented market achieved the highest YoY growth.
Ingram launches CRM backup on cloud marketplace
AvePoint Cloud Backup for Dynamics 365 is a multi-tenant solution, designed with specific features to enable channel partners and MSPs.
Trend Micro introduces cloud and container workload security offering
Container security capabilities added to Trend Micro Deep Security have elevated protection across the DevOps lifecycle and runtime stack.
Veeam joins the ranks of $1bil-revenue software companies
It’s also marked a milestone of 350,000 customers and outlined how it will begin the next stage of its growth.
Veeam enables secondary storage solutions with technology partner program
Veeam has worked with its strategic technology alliance partners to provide flexible deployment options for customers that have continually led to tighter levels of integration.
Veeam Availability Orchestrator update aims to democratise DR
The ability to automatically test, document and reliably recover entire sites, as well as individual workloads from backups in a completely orchestrated way lowers the total cost of ownership (TCO) of DR.