Employee records linked to more than 198,000 NZ companies and entities were found on the dark web. File photo. Photo: Andrew Brookes, AB Still Ltd, www.andrewbrookes.co.uk
Thousands of leaked credentials for employees from NZ government departments and healthcare organisations can be found on the dark web, says a digital security firm.
The data is part of more than 150 million compromised records connected to New Zealand that is accessible on the dark web, according to a study by Kiwi tech start-up nWebbed Intelligence.
The company's cybersecurity study analysed more than 30 billion credentials available for sale on the dark web and found links to more than 198,000 New Zealand companies and entities.
It also found the usernames and passwords of more than 18,000 NZ government workers, 3200 banking staff and 2000 healthcare organisation accounts were in leaked databases.
nWebbed Intelligence founder Julian Wendt said local organisations were underestimating the scale of cyber risk, and an urgent review of cybersecurity protocols was needed in the country's sensitive institutions and corporations.
"We are seeing widespread exposure of compromised credentials linked to core parts of the New Zealand economy, including health providers, government agencies, banks and large-scale businesses.
"These are trusted institutions that Kiwis interact with every day, and they are real emails and passwords sitting in the wild. They're searchable, for sale and vulnerable to exploitation."
He said some breaches were going undetected for years.
"It's not that someone was hacked once and that's it. In many cases, credentials from five or six separate breaches are still sitting out there, waiting to be exploited."
Qantas recently revealed an attack by cybercriminals may have accessed as many as six million customer records.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
