| Cyber attacks are deliberate attempts to steal data, disrupt systems, or take money from a business. This guide groups them into eight types: phishing, ransomware, credential theft, business email compromise, insider threats, supply chain breaches, exploitation of unpatched systems, and denial of service. Most real incidents involve more than one of them. |
On a Tuesday afternoon your accounts administrator opens an email from a supplier you have used for six years. Same signature, same tone, correct invoice number. The bank account is different. She pays it, because nothing about it looks wrong.
There was no virus and no breached firewall, and nobody did anything obviously careless. The cyber attacks that take the most money off New Zealand businesses tend to look like ordinary Tuesday admin, and the other seven types of cyber attacks in this guide are much the same.
New Zealand’s National Cyber Security Centre logged 1,164 cyber security incidents in the first three months of 2026, and phishing and credential harvesting made up 437 of them, more than any other category, with scams and fraud second. Those reports cover individuals as well as organisations of every size, because the entry points barely change between a 25-person firm and a large organisation.
Reviewing the quarter’s three most serious incidents, NCSC Chief Operating Officer Mike Jagusch was direct about the cause. Basic measures such as multi-factor authentication, managing who has full access to the network, and protecting the network edges “could have helped to defend against these incidents”. Those three were the most severe New Zealand has seen since the 2021/22 financial year, and they struck organisations of national significance. The controls that would have blunted them are the same ones a New Zealand business can switch on this month.
This guide covers the eight types of cyber attacks that matter to New Zealand businesses, what they cost in practice, and which doors to shut first.
What Are Cyber Attacks and How Do They Actually Work?
Cyber attacks usually follow four stages: reconnaissance, initial access, escalation, and payoff. Attackers scan for exposed systems, get in using a stolen password or a clicked link, hunt for administrator rights, then encrypt your files or redirect a payment. It is a simplified picture rather than a rule, and plenty of attacks skip a stage entirely.
In plain terms: someone works out who your staff are and what systems you run, they obtain one set of login details, they use those details to reach further than that account should allow, and then they take something.
Reconnaissance in most cyber attacks is cheap and constant. Attackers harvest staff names from LinkedIn, check whether your email domain has weak sender protections, and look for anything reachable from the internet. None of it requires skill or a target list.
Most of the damage happens at escalation. A single compromised laptop is bad enough on its own, because it exposes the files held on it, any saved passwords, and the sessions the user is still signed into. If the account signed into it holds administrator rights, the attacker reaches payroll, client files, and the backups as well.
Blocking every attempt at stage one is unrealistic, and you do not need to. Breaking the chain at any stage stops the payoff, which is the argument for several overlapping controls instead of one product.
Is a Cyber Attack the Same as a Data Breach?
A cyber attack is the attempt to get in. A data breach is one possible result. In New Zealand law the term is privacy breach, and it is broader than most people expect. Under the Privacy Act 2020 it covers unauthorised or accidental access to personal information, and also the sharing, alteration, loss or destruction of it, or anything that stops you reaching it at all. Ransomware that encrypts your client records is a privacy breach even if nobody read a single file.
Three things are worth keeping apart. A cyber attack is deliberate. A privacy breach can happen by accident with no attacker involved, such as an email sent to the wrong recipient. A notifiable privacy breach is the subset that has caused or is likely to cause serious harm, and only that subset triggers the duty to notify under the Privacy Act. Plenty of attacks cause real downtime without ever becoming a notifiable breach.
Are Cyber Attacks Automated or Targeted?
Cyber attacks are both automated and targeted, and the mix has shifted towards automation. Scanning tools find exposed systems within hours of them going online, so small businesses get discovered without anyone choosing them specifically.
Targeted attacks follow for anything that looks profitable. Law firms, real estate agencies, and any business handling large transfers get individual attention because the payoff justifies the effort.
How Has AI Changed Cyber Attacks?
AI has made reconnaissance and social engineering faster and cheaper. The NCSC has warned that frontier AI models let attackers find and exploit weaknesses at unprecedented speed and scale, while noting the same models can assist defence and that the best preparation remains getting the basic measures in place.
The warning signs people were taught to watch for have mostly gone. Phishing emails now use correct grammar, accurate company detail, and a plausible reason to hurry. The old advice about spotting typos no longer applies.
Why Do Cyber Attacks Hit Smaller New Zealand Businesses Hardest?
Attackers concentrate on smaller New Zealand businesses because a 25-person firm with no dedicated security staff is faster and cheaper to break into than an enterprise with a security team on shift around the clock. Automation has made the smaller payoff worth chasing.
Four patterns explain most of the exposure we see in New Zealand businesses.
Nobody Is Watching Overnight
Attackers time their move for when nobody is looking. Encryption often starts on a Friday evening or over a public holiday, which hands them the whole weekend.
With no monitoring in place, you find out when the first person opens a laptop on Monday and nothing loads. By then the encryption has finished and recovery runs into days. Monitoring shortens that gap, often to minutes while the problem is still confined to one machine. How much it helps depends on what is covered, whether someone is available to act on the alert, and how far the attacker had already gone before it fired.
Security Sits Outside the Annual Plan
Patching schedules, backup testing, and access reviews rarely make the annual planning agenda until something breaks. Growth and hiring take the available attention, and security renewals often lapse without anyone noticing.
One unpatched machine is enough to get an attacker inside. It only needs to be reachable from the internet and running software with a publicly known weakness for automated tooling to find it, usually within days of that weakness being published.
Training Wears Off Faster Than People Expect
Staff who have never seen a convincing fake invoice have no reference point for spotting one. Induction-only training fades within a few months, and the techniques change faster than that.
Ongoing continuous staff training works when it runs continuously and includes simulated phishing, so you can see whether click rates are actually falling. A programme with no measurement tells you nothing about whether your team improved.
Tools Get Adopted Without IT Knowing
Staff sign up for file-sharing apps, AI assistants, and project tools to get work done. Those accounts sit outside your security controls, often with reused passwords and no multi-factor protection.
This is shadow IT, and it widens your exposure to cyber attacks without anyone ever formally deciding to accept the extra risk.
What Are the Eight Most Common Types of Cyber Attacks?
The eight most common types of cyber attacks are phishing and credential harvesting, ransomware, credential theft and account takeover, business email compromise, insider threats, supply chain breaches, exploitation of unpatched systems, and denial of service. Phishing leads by a wide margin in New Zealand, with 437 reported incidents in the first three months of 2026.
Real incidents usually combine several of these cyber attacks. A phishing email harvests a password, the password enables account takeover, the mailbox is then used for business email compromise, and ransomware arrives last if the attacker finds nothing easier to monetise. Stop the phishing email and the rest of that chain never happens.
| Threat | What it looks like in a business | First control to check |
|---|---|---|
| Phishing and credential harvesting | A cloned Microsoft 365 sign-in page collects a staff password | Multi-factor authentication on every account |
| Ransomware | Staff arrive, nothing opens, and a ransom note sits on the desktop | A backup you have actually restored from |
| Credential theft and account takeover | Someone logs in as a staff member and reads email for weeks | Alerting on new forwarding rules and unusual sign-ins |
| Business email compromise | A supplier emails new bank details just as payment is due | Verify every bank change by phone, on a number you hold |
| Insider threats | A client list goes to a personal address before a resignation | Offboarding checklist and regular access reviews |
| Supply chain and third-party breaches | A vendor holding access to your systems is compromised | Written breach notification terms with critical vendors |
| Exploitation of unpatched systems | An unpatched firewall or VPN is found by automated scanning | Critical patches on internet-facing systems within two days |
| Denial of service | Your online store cannot take orders for several hours | What mitigation your hosting and internet providers include |
Phishing and Credential Harvesting
Phishing is a fake message designed to make you enter your login details on a page the attacker controls. It remains the single most reported category in New Zealand.
Modern versions clone your Microsoft 365 sign-in page precisely and can relay your multi-factor code in real time. Our guide to phishing scams covers the current techniques in detail.
Ransomware
Ransomware encrypts your files and demands payment for the key. Staff arrive, nothing opens, and a text file on the desktop sets out the terms.
Attackers now steal a copy of the data before encrypting it, so refusing to pay still carries a threat of publication. Restoring from backup no longer settles it on its own.
Paying does not reliably return your data, and it marks the business as willing to pay again. The dependable answer is backups you have tested, held in a form that cannot be altered or deleted even by someone holding your administrator password. Several widely held assumptions about ransomware still lead owners to the wrong conclusion here.
Credential Theft and Account Takeover
Credential theft uses a valid username and password to log in as a legitimate user. A successful login looks ordinary in the logs, which is why this activity often runs for weeks before anyone notices.
There is usually a signal, though. Microsoft 365 raises alerts for suspicious forwarding rules and unusual sign-ins, and the other major platforms do the same. The catch is that the alert has to reach someone whose job it is to look at it. Otherwise the attacker reads email, sets a mailbox rule to forward a copy of every invoice, and waits for something worth intercepting.
Passwords reach attackers through phishing, reuse across breached third-party sites, and malware on home devices. Enforcing multi-factor authentication on every account blocks the overwhelming majority of these attempts, and phishing-resistant methods such as passkeys close most of what is left.
Business Email Compromise
Business email compromise is a scam in which an attacker impersonates a supplier, executive, or colleague to redirect a genuine payment into their own account. No malicious software is involved, so email filters frequently miss it.
A typical sequence runs like this. The attacker gains access to a mailbox and watches it without touching anything. They wait for an invoice discussion to begin. Then they send updated bank details from a lookalike domain, timed to arrive when the payment is expected.
Verifying every change of bank account by phone, on a number you already hold, stops nearly all of it. It costs nothing and needs no software. Any business can start doing it this week.
Insider Threats
Not all cyber attacks come from outside. Insider threats come from people who already have legitimate access, and most are careless. A staff member emails a client list to a personal address before resigning, without thinking of it as theft.
Access reviews and offboarding discipline do most of the work here. Our guide to insider threats sets out the practical controls.
Supply Chain and Third-Party Breaches
Supply chain cyber attacks reach you through a supplier, software vendor, or IT provider you trust. Compromising one vendor can open a route into that vendor’s customers, and how far it reaches depends on what access the vendor holds and which service was affected.
Ask your key suppliers what controls they hold and how quickly they would tell you about a breach. Contracts with your most critical vendors should state those notification timeframes explicitly, and any provider with administrative access to your systems should be able to answer without hesitation.
Exploitation of Unpatched Systems
Exploitation targets known weaknesses in software you have not updated. Once a vulnerability becomes public, automated scanning finds exposed systems within days.
Priority goes to anything sitting where your network meets the internet: firewalls, VPN appliances, remote access gateways, and web servers. The NCSC specifically cited protection of those network edges as a factor in the serious incidents it handled this year.
Denial of Service
Denial of service floods your systems or internet connection with traffic until legitimate users cannot get through. You lose trading hours instead of data, and an online store that cannot take orders for six hours has still lost six hours of orders.
Extortion demands sometimes accompany these cyber attacks, with a threat to keep the flood running until payment arrives. Any business taking orders, bookings, or payments online should confirm what mitigation against these cyber attacks its hosting and internet providers already include, because most include some and few businesses know which.
What Do Cyber Attacks Actually Cost a New Zealand Business?
Cyber attacks caused NZ$5.6 million in directly reported losses in New Zealand in the first three months of 2026, up 76% on the previous quarter. Individuals accounted for NZ$5.2 million of that and organisations for roughly NZ$400,000. Despite the quarterly rise, the total sits below the average of the past two years.
Do not read too much comfort into it. The figure captures only what was reported to the NCSC, and reporting is voluntary, so plenty of businesses go to their insurer or the Police instead. It also excludes downtime and recovery costs, which are usually the larger part of the bill for a business.
Look at how the losses cluster. Just 42 incidents of NZ$10,000 or more accounted for 97% of all reported losses that quarter. That tells you reported losses sit with a small number of incidents. It does not tell you which one you would get, and it says nothing about the downtime that never reaches the figures at all.
How Should You Estimate Your Own Exposure?
Estimate the cost of cyber attacks to your business by starting with your own downtime, because that is the number a national total cannot give you. Work out what one day of not trading costs you in lost gross profit rather than turnover, so you are not counting costs you would have carried anyway.
Then model three lengths instead of assuming one: a short interruption of a day or so, a medium one of several days, and an extended one where a core system is unavailable for a fortnight. Which of those is realistic for you depends on your own restore tests and on how many systems depend on each other, which is why a business that has never tested a restore cannot answer this honestly.
Add the costs that sit outside the outage itself: investigation, legal advice on notification, telling customers, hardware replacement, and the overtime needed to clear the backlog. Keep delayed revenue separate from revenue you never get back, because invoicing a week late is a cash flow problem rather than a loss.
Most businesses forget to count the fortnight afterwards, when staff are rebuilding records and chasing confirmations instead of serving customers. For most firms we assess, the full total lands well above several years of the preventative spend that would have avoided it.
What Are Your Legal Obligations After a Breach?
Under the Privacy Act 2020, you must notify the Office of the Privacy Commissioner and affected individuals of any privacy breach that has caused or is likely to cause serious harm. Notification is required as soon as you are practically able, and the Commissioner has indicated an expectation of within 72 hours of becoming aware that a breach is notifiable. You are not expected to wait until the investigation is finished. Notify on what you know and update the Commissioner as the picture becomes clearer.
Failing to notify the Privacy Commissioner without reasonable excuse is an offence under section 118 of the Privacy Act 2020, carrying a fine of up to $10,000, alongside the possibility of a public compliance notice. Our guide to NZ Privacy Act cybersecurity explains the controls the Act expects you to have in place.
How Do Cyber Attacks Affect Customer Trust?
Reputational damage from cyber attacks lasts longer than the technical recovery. Clients who receive a breach notification about their own personal information will ask what changed afterwards.
Clients who hear a clear answer about what changed generally stay. Vague reassurance costs you some of them at renewal.
Does Cyber Insurance Cover the Loss?
Cyber insurance covers a defined portion of the cost, commonly including incident response, forensic work, and business interruption. Coverage depends entirely on the policy wording.
Underwriters now ask detailed questions about controls before quoting. Missing multi-factor authentication or endpoint detection can reduce a payout or invalidate cover, so work through the questionnaire before you need to and fix whatever you cannot answer yes to.
How Do You Prevent Cyber Attacks Without a Big IT Budget?
Most cyber attacks are stopped by two inexpensive controls: multi-factor authentication on every account, and prompt patching of anything facing the internet. Tested backups belong beside them, but they do a different job, which is getting you back on your feet after something gets through. Reviewing the country’s three most serious incidents this year, the NCSC pointed to multi-factor authentication, managing who holds full access to the network, and protecting the network edge. Work through the following list in order.
Enforce multi-factor authentication everywhere
On email, remote access, and any cloud application holding customer data. This single control blocks the largest share of cyber attacks for the least cost.
Patch to the NCSC minimum standard
Critical security updates on anything facing the internet within two days, and within two weeks on internal systems. Where a weakness is already being exploited, treat it as an emergency rather than waiting for the next patch window. Automate what you can so it does not depend on someone remembering.
Follow the 3-2-1-1 rule for backups
Three copies, two media types, one offsite, one offline or unable to be altered. Restore something every quarter, because an untested backup has a real failure rate and you want to discover that on a quiet Tuesday.
Restrict administrator rights
Give them only to the people who genuinely need them, and use separate accounts for admin work. Many attacks fail at the escalation stage when admin rights are scarce.
Deploy endpoint detection and response
On every device, including laptops that leave the office. Cyber insurers increasingly expect it as a condition of cover.
Verify every payment detail change by phone
Using a number you already hold. This one procedural rule defeats most business email compromise.
Run continuous awareness training
With simulated phishing, so you can see whether click rates are actually falling.
You do not need a large team for any of this. Put one person’s name against each control, set a recurring reminder, and check every quarter that they are all still switched on.
Which Cyber Attacks Should You Defend Against First?
For most New Zealand SMEs, the four cyber attacks to defend against first are credential theft, phishing, business email compromise, and ransomware. These four combine high likelihood with high cost, and they sit ahead of the threats that get the most media coverage.
Weighting shifts with the business. A Christchurch professional services firm holding client financial data should weight credential theft and business email compromise heavily. A manufacturer running production systems should weight ransomware and unpatched systems higher, because downtime halts output immediately. An online retailer needs denial of service mitigation that a purely office-based firm can reasonably skip.
An IT assessment works this out for your specific operation. It maps which types of cyber attacks actually threaten you, identifies which controls you already hold, and separates what is urgent from what is worth planning for. If you would rather judge an assessment before commissioning one, our guide to choosing a cyber security assessment covers what a good one should deliver.
How Often Should the Priorities Be Reviewed?
An annual review suits most SMEs, with an extra review after any significant change. New systems, new premises, an acquisition, or a shift to more remote working all alter the exposure.
Reviewing after an incident matters just as much, including near misses. If one staff member reported a phishing email and another clicked it, run the next training round on that team.
What Are the Warning Signs of a Cyber Attack?
Most cyber attacks show up first as small operational oddities, not as an obvious alarm. The warning signs worth acting on the same day are:
- Staff locked out of an account that worked yesterday, with no password change on record
- Colleagues or clients receiving emails from your address that nobody sent
- Mailbox rules or forwarding addresses that nobody in the business created
- Multi-factor prompts arriving on a phone when that person is not logging in
- Shared drives or line-of-business software slowing down sharply without a known cause
- New user accounts, or existing accounts suddenly holding administrator rights
- Antivirus or endpoint software switched off or reporting that it cannot update
Any one of these can have an innocent explanation, but do not wait for a second. An unexplained forwarding rule, or an account that has quietly gained administrator rights, is worth investigating on its own.
How Long Do Attacks Go Unnoticed?
Credential-based cyber attacks commonly run for weeks before detection, because a valid login raises no alarm. Ransomware is the exception, since it announces itself the moment encryption finishes.
That gap between entry and discovery is the argument for monitoring. It is also why the mailbox rule check is worth doing today rather than after something goes wrong.
How Should Your Cyber Attack Response Work in the First Hour?
An effective cyber attack response starts with containment, and the right first move depends on what has happened. Call the bank if money has moved, revoke sessions if an account has been taken over, and disconnect the device if it is infected. In every case, call your IT provider and start a written timeline.
If money has already been paid, call your bank before anything else. Own Your Online advises contacting your bank as soon as you can so it can attempt to reverse the payment, and that window is short. Then warn the supplier whose invoice was faked, on a number you already hold rather than one taken from the email.
If a cloud account has been taken over, reset the password and revoke active sessions, then check for forwarding rules, mailbox rules and any new sign-in methods the attacker has added. Do this from a device you know is clean.
If a device is infected, disconnect it from the network without powering it off, because evidence held in memory disappears when it shuts down.
Whichever applies, contact your IT provider on a channel the attacker cannot see, let one person coordinate containment and evidence, and keep a written record of what was done and when.
People routinely skip revoking active sessions. A password change on its own does not end a session the attacker is already inside, so they carry on working while you think the door is shut. The other easy one to forget is checking whether personal information was involved, because that starts the Privacy Act clock.
Deciding all of this while the phones are ringing rarely goes well. A documented incident response plan assigns each step to a named person in advance, and a current data backup strategy gives you the option to restore. Our Christchurch and Dunedin teams both hold after-hours contacts for exactly this reason.
How Does a Managed IT Partner Reduce the Risk of Cyber Attacks?
A managed IT partner reduces cyber attack risk by running patching, backup verification, monitoring, and access reviews to a fixed schedule instead of whenever someone finds spare time. Every one of those controls slips when it competes with other priorities.
Exodesk has supported New Zealand businesses since 1989, from offices in Christchurch and Dunedin. Our cyber security services cover monitoring, patch management, endpoint detection, backup testing, and staff training as one managed programme, with a local team that can be on site when something needs hands on it.
What Should You Expect From a Provider?
Expect specifics, in writing. A provider should tell you which devices carry endpoint detection, when the last backup restore was tested and whether it succeeded, how quickly critical patches get applied, and who to call outside business hours.
Ask what happens during an active incident as well. Response time commitments, escalation paths, and whether the provider carries its own cyber liability cover all matter during live cyber attacks, even if they seem like small print during a sales conversation. Any provider holding administrative access to your systems is part of your supply chain risk, so their internal controls deserve the same scrutiny you would apply to your own.
Close the Eight Doors Before Someone Tries Them
Most of the eight types of cyber attacks described here are stopped by controls you can put in place this quarter, not by a project that takes a year and a new budget line.
If you are not certain that multi-factor authentication is enforced on every account, start there this week. The second call to make is finding out whether your last backup restore actually worked.
Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.
Frequently Asked Questions
What are the most common types of cyber attacks on New Zealand businesses?
Phishing and credential harvesting top the list. The NCSC recorded 437 phishing and credential harvesting incidents in the first three months of 2026, more than any other category, with scams and fraud second. Ransomware, account takeover and business email compromise are the other types small and medium firms most often deal with, though the NCSC figures do not rank those separately.
How many cyber security incidents happen in New Zealand each quarter?
The National Cyber Security Centre responded to 1,164 incidents between January and March 2026. Of those, 77 required specialist technical support and three were classified as highly significant, the first incidents of that severity since the 2021/22 financial year.
Do hackers target small businesses in New Zealand?
Small and medium businesses are targeted heavily because they are cheaper to break into for a similar payoff. Automated scanning finds exposed systems regardless of company size, and most cyber attacks on smaller firms go undetected for longer because nobody is employed to watch for them.
What is business email compromise and how is it different from phishing?
Business email compromise is a scam in which an attacker impersonates a supplier, executive, or colleague to redirect a genuine payment into their own bank account. Phishing, by contrast, aims to capture login credentials. Business email compromise usually involves no malicious software at all, which is why email filters often fail to catch it.
Does multi-factor authentication stop cyber attacks on its own?
Multi-factor authentication blocks the overwhelming majority of password-based attacks but does not stop every one. Attackers can relay codes in real time or fatigue users into approving prompts. Phishing-resistant methods such as passkeys or hardware security keys close that remaining gap.
Should a business ever pay a ransomware demand?
Ransom payment is discouraged by New Zealand government guidance. Payment does not reliably restore data and identifies the business as willing to pay again. Tested offline backups and a documented recovery plan let a business decline the demand.
What is the correct cyber attack response in the first hour?
The first step is containment, and the right first move depends on the incident. If money has been paid, call your bank immediately so it can try to reverse the payment. If an account has been taken over, reset the password, revoke active sessions and check for new forwarding rules. If a device is infected, disconnect it from the network without powering it off. In every case contact your IT provider and begin a written timeline. Preserving evidence matters for both insurance claims and any report to the Privacy Commissioner.
Do cyber attacks have to be reported in New Zealand?
Notification is required under the Privacy Act 2020 when a privacy breach has caused or is likely to cause serious harm. A privacy breach is broader than theft, covering the loss, alteration or destruction of personal information as well as being unable to reach it, so ransomware can qualify even if nothing was taken. The Privacy Commissioner and affected individuals must be told as soon as you are practically able, with the Commissioner indicating an expectation of within 72 hours. Failing to notify the Commissioner without reasonable excuse carries a fine of up to $10,000.
How much does it cost to protect a small business against cyber attacks?
Protection costs depend on staff numbers and existing systems, though the three highest-value controls are inexpensive. Multi-factor authentication, automated patching, and tested backups typically cost less than a single day of unplanned downtime. An IT assessment shows which of these you already have and what is missing, which is what any costing has to be built on.
How does Exodesk help protect against cyber attacks?
Exodesk delivers monitoring, patch management, endpoint detection, backup verification, and staff awareness training as one managed service. Teams in Christchurch and Dunedin support businesses across New Zealand, with on-site response available when remote work is not enough.
Which of these eight would get through today?
For most businesses the honest answer is that nobody has checked. A free IT assessment looks at the controls these attacks actually target: patching, email filtering, multi-factor authentication on administrator accounts, and whether the backup has ever been restored from.
Or read more about our cyber security services.
