Financially Motivated Attacks on NZ Businesses Are Up 18%. Here's Where the Money Goes.

Of the 369 incidents of potential national significance handled by the NCSC in 2025/26, 162 were linked to criminal or financially motivated actors. That's a rise of 18% on the previous year. And alongside that increase in volume came an increase in severity: four incidents were classified as C2, or Highly Significant, during the year. That matches the total number of incidents at that severity level recorded across the previous decade combined.

The NCSC's head Catriona Robinson put it plainly: "The severity of incidents has increased."

This is not a story about sophisticated nation-state attacks on critical infrastructure. The bulk of that 18% rise represents criminals targeting NZ businesses for financial gain - the same businesses operating in Auckland, Christchurch, Wellington, and Hamilton that have been investing in better security but still, clearly, not staying ahead.

Understanding where the money goes in a financially motivated attack is the starting point for understanding what actually stops them.

The Four Ways Financially Motivated Attackers Make Money From NZ Businesses

Financially motivated cybercrime is not random. Attackers follow established playbooks with known economics. The four dominant methods - ransomware, business email compromise, data theft and extortion, and fraud - each have a specific logic and a specific defence.

Ransomware: The Operational Disruption Model

Ransomware remains the highest-profile financially motivated attack type, and the NCSC's 2026 findings confirm why: it works.

The model is straightforward. An attacker gains access to a business environment - typically through a phishing email, a compromised credential, or an unpatched vulnerability - and deploys encryption software across as many systems as possible. When the business can't access its files, its systems, or in some cases its backups, the attacker presents a demand: pay in cryptocurrency to receive a decryption key.

The economics are brutal for victims. The NCSC cites Hiscox survey data finding that approximately 40% of victims who paid a ransom failed to recover their data, and approximately 80% of organisations that paid were attacked again - often by the same group. Paying doesn't resolve the underlying compromise. It signals that payment is possible.

For NZ businesses, the operational disruption cost typically exceeds the ransom itself. A business earning $2 million annually loses roughly $38,000 per week of downtime. Extended outages - which are common when backups are compromised or untested - multiply that figure significantly.

The NCSC's 2025/26 data records a doubling of attacks on health care, social assistance, education, and training. These sectors were already in the headlines following the ManageMyHealth, MediMap, IntraCare, ZenTech, and Canvas breaches. They are targeted because they hold sensitive data that creates extortion pressure, operate on tight operational timelines where downtime has immediate consequences, and in many cases have accumulated security debt over years of under-investment.

Business Email Compromise: The Impersonation Model

Business email compromise consistently appears as one of New Zealand's highest-loss incident categories, and the NCSC's 2026 report reinforces why it's so effective: it doesn't require technical sophistication. It requires access to an email account and patience.

The mechanism is well-documented. An attacker gains access to a legitimate business email account - through phishing, through credential theft, or through a brute force attack on a weakly protected account. They monitor the inbox, identify pending financial transactions, and at the right moment intervene - sending a payment instruction that appears to come from a trusted contact, requesting a change of bank account details, or creating urgency around a transaction that's already in progress.

For professional services firms, law practices, accountancies, real estate agencies, and property developers - all businesses handling significant financial transactions regularly - this attack is specifically calibrated to how they operate. The NCSC's data shows BEC attacks are concentrated in sectors where large payments are routine and trust relationships are established.

The NZ-specific context makes this more acute. Property transactions, in particular, represent some of the largest single payments NZ businesses process. The NCSC has documented multiple cases where settlement payments were intercepted, with losses in the hundreds of thousands of dollars, through BEC attacks on property-related email accounts.

AI is making this worse. The NCSC's 2026 report warns explicitly that AI is already improving phishing, scams, deepfakes, and social engineering by producing more convincing material tailored to individual targets. The badly-written BEC email is being replaced by one that mirrors the sender's actual writing style, references the specific transaction in progress, and arrives at the precise moment when urgency is highest.

Data Theft and Extortion: The Leverage Model

The NCSC's 2026 report documents a case study that illustrates this pattern precisely. An individual obtained sensitive information about a New Zealand organisation, then threatened to release it unless payment was made. The threat wasn't to encrypt systems - it was to publish or sell information that the organisation couldn't afford to have disclosed.

This model - sometimes called extortion without encryption, or pure data extortion - is growing. It doesn't require deploying ransomware. It doesn't require extended system access. It requires finding sensitive information, exfiltrating it, and making credible the threat to release it.

For NZ businesses, the information that creates the most leverage is health information (permanent, unalterable, highly regulated), legal privilege (where disclosure could affect active matters), financial information (where disclosure could affect competitive position or regulatory standing), and personal data about individuals (where disclosure creates Privacy Act obligations and reputational damage).

The Canvas learning management system breach in May 2026 - a supply chain attack affecting over 110,000 students and staff at NZ tertiary institutions - is a prominent example of the scale data theft can reach when it targets a system that multiple organisations depend on. One compromised vendor, many affected organisations.

Fraud: The Identity and Credentials Model

Beyond BEC, a broader category of financial fraud targets NZ individuals and businesses through credential theft, identity compromise, and payment fraud.

The NCSC's quarterly reports have consistently documented credential harvesting as the most common incident type by volume. Phishing campaigns capture usernames and passwords. Those credentials are used directly, sold on criminal marketplaces, or combined with other breach data to build profiles used for identity fraud.

For businesses, compromised staff credentials are the starting point for a significant proportion of the other attack types. A stolen Microsoft 365 login is the entry point for email account access, SharePoint data theft, Teams conversation monitoring, and the subsequent impersonation that enables BEC.

The NCSC's 2026 report also documents a genuinely new threat: North Korean IT workers covertly securing remote IT employment with NZ businesses, earning foreign currency for the state while potentially establishing access to business systems. This represents the intersection of financially motivated criminal activity and state-sponsored behaviour - the categories are increasingly blurred.

What the Money Trail Reveals About the Defence

Following the money through each attack type reveals something consistent: the point at which financially motivated attacks succeed is almost always the same. An attacker is in an environment they shouldn't be in, for longer than they should have been there, before anyone notices.

The NCSC's own analysis supports this. The four C2-classified incidents in 2025/26 - the most severe level, matched over the previous decade combined - weren't necessarily more sophisticated than previous attacks. They were more damaging because of what the attackers were able to do before they were detected.

This is the dwell time problem. As we covered in our post on how long your business was exposed before anyone noticed, the global median dwell time is 14 days - the gap between initial access and detection. In that window, a ransomware group identifies and destroys backups, escalates privileges, and positions for maximum damage before deploying encryption. A BEC attacker monitors correspondence, identifies the optimal transaction to intercept, and prepares the fraudulent payment instruction. A data extortionist copies the files that will be used for leverage.

Earlier detection doesn't prevent every attack from succeeding. It dramatically limits what the attacker can do before they're stopped.

The Sectors Facing the Highest Financial Exposure

The NCSC's 2026 data and the pattern of NZ incidents this year point to several sectors carrying elevated financial exposure from these attack types.

Healthcare and social assistance saw attacks double in 2025/26. Health data is permanently valuable to attackers - it cannot be changed after a breach, creating lasting extortion leverage and a persistent criminal market. The ManageMyHealth, MediMap, IntraCare, and ZenTech incidents illustrate what that looks like in practice.

Education and training also saw attacks double. The Canvas breach affecting over 110,000 students and staff at NZ tertiary institutions in May 2026 demonstrated the supply chain attack vector - one compromised vendor with multiple affected organisations downstream.

Professional services, legal, and financial services remain consistently targeted for BEC precisely because of the financial transactions they handle. A single intercepted settlement payment can exceed the annual cost of a comprehensive security programme.

Construction and engineering hold project data with commercial value - tender pricing, engineering methodologies, subcontractor rates - alongside the operational timeline pressure that makes ransomware particularly effective.

What Good Defence Against Financially Motivated Attacks Looks Like

The NCSC is direct about this, and the 2026 report repeats what every previous year has found: the strongest protection against financially motivated attacks remains security fundamentals, applied consistently.

MFA universally enforced. Patches applied on a defined schedule. Backups tested and isolated. Staff trained specifically on social engineering and BEC. Conditional Access policies that reduce the impact of compromised credentials. And someone actively watching the environment for the signs that an attacker is already present.

That last point is where the gap sits for most NZ SMEs. Security tools detect and alert. Detection requires someone to investigate those alerts continuously - not during business hours when convenient, but around the clock when attacks are actually occurring.

The NCSC's data shows that criminal activity has increased and severity has increased. For businesses that have invested in security controls but not in continuous monitoring, the question the 2026 report raises directly is: would you detect the attacker during their dwell period, or would you find out the same way the four C2-classified incidents were found - after the damage had been done?

NSP's Managed Detection and Response service provides continuous monitoring across Microsoft 365 environments - identity, email, endpoints, and cloud activity - specifically designed for NZ SMEs that need enterprise-grade detection without the cost of building it internally. For businesses with significant financial transaction exposure, the detection capability that limits attacker dwell time is the most direct response to what the NCSC's 2026 data describes.

Frequently Asked Questions

What does the NCSC's 2026 Cyber Threat Report say about financially motivated attacks on NZ businesses?

The report found 162 of the 369 incidents of potential national significance handled by the NCSC in 2025/26 were linked to criminal or financially motivated actors - an 18% increase on the previous year. Four incidents were classified as C2, or Highly Significant, matching the total number at that severity level across the previous decade. Attacks on healthcare, social assistance, education, and training doubled. Direct financial losses reported reached $23.8 million, with the NCSC noting that reported figures represent only a portion of the full economic cost.

What is business email compromise and why does it affect NZ businesses specifically?

Business email compromise involves an attacker gaining access to a legitimate business email account, monitoring financial transactions, and intervening to redirect payments to an account they control. It targets businesses that process large financial transactions regularly - professional services, legal firms, real estate agencies, accountancies, and property developers. NZ's active property market and the scale of transactions in professional services make these sectors consistent targets. AI is increasing the sophistication of BEC by enabling more convincing impersonation at scale.

What is the difference between ransomware and data extortion?

Ransomware involves encrypting a business's systems and demanding payment for a decryption key. Data extortion involves stealing sensitive information and threatening to publish or sell it unless payment is made - without necessarily encrypting anything. Both are financially motivated. Data extortion can be executed faster and requires less technical access than ransomware, making it an increasingly common variant. The NCSC's 2026 report documents both patterns in NZ incidents.

How does the NCSC define a C2 or Highly Significant incident?

C2 is the NCSC's highest classification for cyber incidents, reserved for events with significant national impact. The NCSC recorded four C2-classified incidents in 2025/26 - as many as in the previous decade combined. This designation reflects both the scale of the incidents and their consequences for affected organisations and, in some cases, New Zealand more broadly.

What does the NCSC recommend NZ businesses do in response to the 2026 threat environment?

The NCSC's core recommendations remain consistent: implement MFA, apply patches promptly, maintain tested and isolated backups, and ensure staff are trained on social engineering and phishing. The 2026 report adds an emphasis on preparing for AI-accelerated threats and ensuring that boards and senior leadership are engaged with cyber security as a business risk, not just an IT function.

Does the $23.8 million direct financial loss figure represent the full cost of cyber incidents to NZ?

No - the NCSC explicitly notes that reported direct losses do not represent the full economic cost, which also includes business disruption, outage costs, recovery work, stolen information, and longer-term business impact. The $23.8 million figure is based on incidents reported to the NCSC and represents only a portion of actual losses across NZ businesses.

Is Your Business Actually Protected?

The NCSC's 2026 data shows that financially motivated attacks are increasing in frequency and severity. A free 30-minute consultation with NSP covers your current security posture, the specific risks relevant to your sector and transaction profile, and what continuous monitoring would change about your detection capability.

Book your free consultation →

Or call us directly: 0508 010 101

Related Reading

• How Long Was Your Business Exposed Before Anyone Noticed?
• Your Business Has Cybersecurity Tools. Who Is Actually Watching Them?
• Why NZ Small Businesses Are the Ones Getting Hit With Ransomware
• What a Cyber Insurance Claim Costs NZ Businesses
• Three NZ Breaches in One Week: What Every Business Should Do Next
• Managed Detection and Response - NSP
• Cybersecurity Assessments - NSP