Story image

CERT NZ: Email extortion & scams hit Kiwis hard in the pocket

12 Mar 2019

Despite ongoing efforts to raise awareness about online scams and fraud, New Zealanders are still losing staggering amounts of money.

CERT NZ’s Q4 2018 Quarterly Report puts the total amount lost to cybersecurity issues at $14 million in 2018, of which more than $8 million was lost to scams and fraud.

In the last quarter alone (October-December), CERT NZ received 1333 reports about cybersecurity issues. New Zealanders also lost $4.9 million due to scams and fraud.

“These scams are becoming increasingly professional, they generate a considerable amount of money so scammers evolve their approach and employ new methods to continue tricking people into paying up,” explains CERT NZ director Rob Pope.

Email extortion scams – in which scammers send threatening emails that trick people into paying money to make the problem disappear – accounted for 36% of all scam reports.

“We saw this type of scam evolve rapidly, from webcam blackmail emails that contained personal information like passwords in October, through to bomb threat emails in December. It’s more important than ever that Kiwis have a trusted source they can turn to for actionable advice to protect themselves online,” says Pope.

The bomb threat emails in December were concerning for many New Zealand businesses. The emails threatened to detonate a bomb in the company’s building if the business did not make payment. CERT NZ and many international partners issued an advisory about the hoax. 

Beyond email extortion scams, the report also highlights a significant number of phishing and credential harvesting reports (431), followed by 48 malware reports – more than double the number in Q3.

In one case study, the report tells the story of one New Zealand business with 20 regional offices that caught a malware infection. The malware was delivered by a phishing email that appeared to be from an accounting service.

A company employee clicked the link and unwittingly downloaded malware in the background. The malware is able to display a phony online banking page, which captured the employee’s login and two-factor authentication information.

The attackers access the company’s bank account from an overseas IP address, and it was only then that the bank noticed something was amiss. The bank notified the company.

“The business was concerned that removing the malware from their systems would impact their day-to-day operations. CERT NZ helped the business resolve the incident while maintaining their operations,” the report says.

CERT NZ also issued an advisory to share information about the threat.

“It’s CERT NZ’s job to help New Zealanders report the cyber security incidents they are impacted by and get the information they need to recover. These reports also allow us to aggregate our information alongside international sources to make sure New Zealanders have access to the most up-to-date information on cyber security threats,” says Pope.

If you or your organisation experience a cybersecurity threat – or if you suspect you may have been exposed to one – contact CERT NZ any time at www.cert.govt.nz or call 0800 CERT NZ, Monday to Friday, 7am – 7pm.

Sony and Microsoft to explore strategic partnership
“Our partnership brings the power of Azure and Azure AI to Sony."
Hands-on PSVR preview: Blood & Truth
PlayStation VR fans who picked up a copy of VR Worlds with their headset will have had a taster of SIE London Studio’s Blood & Truth.
Google puts Huawei on the Android naughty list
Google has apparently suspended Huawei’s licence to use the full Android platform, according to media reports.
Govt & Canterbury Uni pour $7m into gaming research
The funding will be used to boost the University of Canterbury’s Applied Immersive Gaming Initiative, which will research and accelerate public use of immersing gaming applications.
This Feilding school has just won an international robotics award (again!)
“In typical Kiwi fashion, our students think laterally to solve challenges, build prototypes, test and retest until they have a working model. All on their own time and all with their own ideas."
New educational game to boost construction skills shortage
The game has been designed to give future business people and construction workers a taste of what it’s like to build their own company.
DJI launches Osmo Action - a handheld action cam with a difference
Hold on to your skis, snowboards, or your camera-mounted stunt cars, because DJI has launched Osmo Action camera.
Study finds NZ mobile services in good stead due to competition
The study found indicators such as pricing, coverage and choice of mobile services were trending in a positive direction for consumers.