Get help now

If an attacker has gained access to your business's data and is releasing it publicly – or selling it – then take the following steps immediately.

1. Disconnect the compromised system from the internet, physically remove network cables if necessary. Do not turn it off, you could lose evidence that will help you work out what happened.
2. Reset the passwords for any compromised accounts and turn on two-factor authentication where possible.
3. Report the breach to the Privacy Commission if it is likely to cause anyone serious harm. This is legally required within 72 hours of discovering the breach under the Privacy Act 2020.
   Report a breach to the Privacy Commission(external link)
4. Contact any customers or stakeholders who are affected.

We can offer support in responding to the breach and with how to communicate to those affected.

Report an incident | CERT NZ(external link)

Protect your business from a data breach

If you’ve lost access to some or all your internal systems, take the following actions.

1. Contact your IT provider immediately, if you have one.
2. Report it to CERT NZ who can provide free advice and guidance on how to deal with this type of attack. Report an incident to CERT NZ(external link)
3. Disconnect the compromised system from the internet, physically remove network cables if necessary. Do not turn it off, you could lose evidence that will help you work out what happened.
4. Restore your system from your most recent backup. If you don't have a backup, you can do reset to factory settings and reinstall your operating system. Check with your IT provider before doing this as it will likely erase all your files.

These sorts of attacks are called ransomware as they often come with a ransom demand from the attackers. We recommend you do not pay the ransom.

Even if the amount seems small, there is no guarantee that you’ll get your access back and paying a ransom could put you at risk of further attacks – if an attacker sees that you're willing to pay them, they might try to target you again.

Protect your business against ransomware

If you’re website is down – and it doesn’t seem to be from a technical issue – it may be a cyber attack. A good indicator is getting a '408' time-out error when trying to access the site.

1. Contact your web administrator, website host, or Managed Service Provider (MSP) to diagnose the issue.
2. Contact CERT NZ. We can help if you're unsure who your provider is or you don't have one, we can also let you know if the issue is wider than just your business. Report an incident | CERT NZ(external link)
3. Contact your customers. A website outage does not mean that any data is at risk and customers could be worried.

It's good to be cautious about suspicious, or simply odd, messages in your email, text or social media. This is the main way attackers can get your details and get into your systems.

1. Do not click any links sent via unsolicited text or social media messages and do not respond.
2. Check links and sender details in suspicious emails by hovering your mouse over them to see where they come from or go to.

These messages, known as 'phishing', often claim to be from known organisations, such as banks or government agencies. Notably, most New Zealand banks have agreed to not send out links in text message communications with customers.

If you only clicked the link, you're usually ok, but if you have shared information or sent money then you need to take the following steps.

1. Contact your bank immediately and they can try and reverse the payment.
2. Update passwords and enable two-factor authentication (2FA) on any associated accounts.
3. Contact the organisation through their official channels to let them know about the messages (chances are, you aren't the only who got one).
4. Report the message. If it's an email forward it to phishpond@ops.cert.govt.nz. If it's a text message, forward it to 7726 – this is a service run by the Department of Internal Affairs (DIA). If it came via social media, report it to the platform (for example, Facebook).

If you have discovered someone claiming to be you online, there are a few steps you can take. This can take a few different forms: a fake website, fake social media profile, phishing emails or someone simply claiming to work for you or represent you.

1.  Report the fake account to the platform it's on (for example: Facebook). If it's a fake website, then contact us and we can work with you and the web hosting company to help get it removed. 
2. Report an incident | CERT NZ(external link)
3. Contact your followers and customers, to let know that there is an imposter and to avoid it. Also tell them to report the fake account if it contacts them.
4. Report to NZ Police if the impersonator has stolen money from your customers. Report to Police(external link)
5. Turn on two-factor authentication (2FA) on your accounts, to stop anyone being able to take over your account and lock you out.

There are two ways this can affect you.

You're sent an invoice or request asking you to pay to a new bank account.

1. Do not reply directly to the message containing the new invoice or request.
2. Contact the company via official channels and verify the new payment details.

Your customers receive an invoice claiming to be from you.

1. Contact all your clients letting them know about the scam and to not pay the fake invoice.
2. Contact your bank to let them know the situation.
3. Report to your IT provider, managed service provider or us as there is a chance that the scammers may have access to your email systems.

Report an incident | CERT NZ(external link)

Responding quickly to an online security incident can limit the impact to your business. Here's where to start.

If you've had an online security incident

Communication, whether it's with your staff, your customers, or the public is a big part of a well-managed incident. Knowing what to say and when to say it can make a big difference to the perception of how well your incident is managed.

Communicating in an online security incident

Every business should do an online security risk assessment. Knowing the risks your business faces and having a plan in place for them can help you prevent — or recover from — a online security incident. Find out how to do one.

Online security risk assessments for your business

Outsourcing some of your online security needs to an IT services provider could help to reduce your risk in future. Here's what to think about before choosing one.

Choosing an IT service provider