Te pānga o ngā pūmanawa tono utu The impact of ransomware

A year in ransomware incidents

Of the 7122 total incidents recorded during the 2023/2024 financial year, the NCSC responded to 46 ransomware incidents, approximately half the number of incidents compared to 2022/2023. Overall, the total number of ransomware incidents in 2023/2024 dropped considerably from previous years.

While the number of ransomware incidents has declined, the severity of impact from ransomware this year was still proportionally more than other cyber security incidents. In 2023/2024, 5 out of the 8 C3 incidents of potential national
significance involved ransomware, or extortion/exfiltration which is often associated with ransomware events.

37 of the 46 ransomware incidents (80%) were not likely to cause nationally significant harm as they impacted smaller organisations or individuals. Ransomware actors likely select smaller enterprises and individuals alongside ‘big game’ targets, since these victims likely have less-mature cyber security capabilities. Emerging players enabled by ransomware-as-a-service are also capitalising on smaller organisations’ vulnerabilities to test their capabilities. In many ransomware incidents where impact was less severe, this was mainly due to effective cyber security measures, including robust backups, automated cyber threat detection, and timely incident response. This is reflected in the following case studies about four ransomware incidents experienced by Aotearoa New Zealand organisations this year:

• In September 2023, the NCSC was made aware of a ransomware event affecting a New Zealand transport organisation’s card service for public transport services. The ransomware affected the system responsible for reconciling account balances with credit card data that facilitates users’ ability to top up their accounts. The NCSC provided the transport organisation with support and guidance to assist with the containment of this incident.
• In November 2023, the NCSC was made aware of malicious cyber activity that indicated ransomware on the network of a New Zealand organisation in the media and telecommunications sector. Subsequent investigation supported by the NCSC indicated the intrusion occurred via a vulnerable remote services tool with weak administration credentials. Due to robust backups (which were not affected) the organisation had the ability to restore the impacted file systems and data.
• In March 2024, the NCSC was notified of possible ransomware activity on the network of an organisation in the manufacturing sector. Access was likely via the exploitation of a known vulnerability in a remote service tool. After gaining access to the network, the actor was observed making attempts to copy sensitive credential databases. Early identification of the activity by a cyber threat detection tool on the network allowed the organisation to remediate the server before the ransomware was deployed.