The bulk of these losses - $6.5 million - have come from scams and fraud. Of this, around $5 million was lost as a result of unauthorised money transfer incidents or business email compromise.

While the number of reports of scams and fraud was largely unchanged from last quarter, the amounts lost have risen from $4.8 million to $6.5 million - a 35% increase.

There were 10 incidents where more than $100k was lost, and 95% of reported loss came from amounts 10,000 and over, continuing a trend from last quarter where a significant number of large loss incidents were recorded.

Report an incident - business and individuals | CERT NZ

The distribution of incident severity categories is reflective of typical previous quarters. The majority of incidents were triaged to be within the C4 to C6 range, predominantly as routine (C5) incidents, and only a small number of significant (C3) incidents took place during the quarter.

Incidents by suspected actors

Where possible, the NCSC links the incidents triaged for specialist support to a known actor or activity grouping.

Of the 77 incidents triaged for specialist technical support between 1 January to 31 March 2025:

• 25% were assessed to be likely linked to state-sponsored actors,
• 37.5% were assessed to be likely linked to cybercrime actors, and
• 37.5% did not have enough evidence to link the activity to a known malicious cyber actor.

The proportion of incidents linked to suspected actor type groupings is broadly consistent with the previous quarter, with ~35-40% of incidents being linked to criminal cyber actors, and ~20-25% of incidents being linked to state-sponsored actors.

Techniques, tactics and procedures (TTPs) 

The NCSC maps the malicious cyber incidents it responds to using the MITRE ATT&CK framework. This helps us understand how malicious cyber actors are targeting New Zealand. For more information see attack.mitre.org External Link .

Consistent with the previous two reporting periods, reconnaissance activity was observed most frequently (34 times) by the NCSC this quarter. Within this activity most cyber actors were gathering victim identity information, predominantly credentials.

The next five most frequently observed MITRE ATT&CK TTPs were:

• Impact (15%),
• Credential Access (14%),
• Initial Access (11%),
• Resource Development (11%) and
• Exfiltration (10%)

NOTE: These findings are derived from activity identified in the course of incident response. It is not necessarily representative of all activity conducted on a victim network.