In total, NCSC recorded 7122 incidents in 2023/2024. The majority of these incidents, 6779, were handled through the NCSC’s general incident triage process because they did not require specialist technical attention. Often, these incidents impacted individual New Zealanders or small to medium businesses. While these incidents did not require specialist or intensive technical attention, they may be highly impactful for the people or organisations they affected.

The 6779 incidents handled through the NCSC’s general triage process was 12.5% lower than the previous year. For these incidents, scams and fraud, and phishing and credential-harvesting were the most common types of incidents in this year. Both incident types generally rely on a person inadvertently taking actions that are part of malicious cyber activity. Most categories of incident experienced an overall decline from 2022/2023 figures, except website compromise and denial-of-service.

Scams and fraud incidents

Of the 6779 incidents handled through NCSC’s general triage process in 2023/2024, 30% related to scams and fraud. Scams and fraud incidents rely on deceiving a legitimate user into doing something, rather than gaining unauthorised access to an account or system. Although the scams and fraud incidents included here are cyber-enabled, they can often only be prevented through the individual identifying them as illegitimate, as opposed to other cyber incidents which are cyber-dependent and can be prevented through cyber security controls. Incidents of scams and fraud includes fake investment ‘opportunities’ that are propagated over email, or online deals that are too good to be true.

This incident type consistently features in the top three incident types reported. During 2023/2024, investment scams saw a 176 increase from the previous financial year (34 to 94 incidents). Extortion/blackmail scams increased from 119 to 136, although the reported financial loss decreased.

Cyber security incidents targeting individuals remain a concern, despite lower numbers of reported incidents. With technology use pervasive within day-to-day life, whether people are buying and selling goods or pursuing career opportunities, threat actors are willing to identify and exploit opportunities to prey on people’s trust.

The NCSC provides general technical advice regarding scam and fraud incidents. Incidents that have potential financial or legal consequences, or where further action is required, are referred to New Zealand Police or other relevant agencies, with consent from the individual or organisation reporting.

Phishing and credential-harvesting incidents

Phishing and credential-harvesting continue to be the most common incidents reported by organisations, despite a 31% decrease from the previous year. This category was the second-most common incident reported by individuals (after scams and fraud) despite decreasing by 19%. The prevalence of this incident type is largely due to its use ranging from unauthorised money transfer to ransomware. The most common phishing impersonation theme was mail or package delivery, making up the vast majority of phishing emails and links. Other impersonation themes include government services, banks, and online shopping.

Unauthorised access incidents

In 2023/2024, the NCSC handled 681 reports of unauthorised access through its general triage process. 601 reports impacted individual New Zealanders, and 57 reports impacted organisations - a 23% and 27% decrease from the previous year, respectively. A further 23 incident reports did not specify who they impacted. A significant portion of these reports involve cyber threat actors gaining unauthorised access to social media accounts. For individuals, this frequently results in malicious messages being sent to their friends and family, spreading malware and furthering the distribution of scams. For organisations, this may include messaging customers as well as purchasing fraudulent ads to spread the same malware and scam messaging. The best ways to prevent unauthorised access include using long, strong and unique passwords, along with multi-factor authentication (MFA) to improve cyber security and reduce opportunities for malicious cyber actors to bypass security controls.