Cyber crime during the COVID-19 pandemic

COVID-19 made us more vulnerable to cyber attacks

When we talk about the impact of the COVID-19 pandemic, we tend to think about the people we have lost or have become sick, or the economic impact the pandemic has had. Less well understood are the opportunities that opened up for cyber crime, as major economies looked to move online almost overnight. 

New Zealand is one of the most vulnerable countries in the world at risk of cyber attacks and a recent study found that 40% of the organisations in New Zealand have experienced at least one data breach after moving to a remote working model, and 37% of employees have faced email phishing attacks. 

Even some of the country's largest organisations have fallen victim to cyber crime in the wake of COVID-19, causing havoc and raising serious questions about our nation's cyber security as a whole. 

The challenges of working from home

New Zealand's rush to adopt a new way of working when nationwide lockdowns were announced left cyber backdoors and windows open at many Kiwi businesses, making them vulnerable to attacks. New Zealand Police estimated that during lockdown Kiwi businesses lost $2.2 million to scammers. 

Declan Ingram, Deputy Director of CERT NZ, says cyber criminals are opportunistic and it's important to be vigilant and make sure we're getting the basics right. 

"The need to work remotely introduces new variables into the way we all operate online. While it can seem like we're set up to work in the same way we might in the office, things are different. 

"This can be the way we're accessing systems and files, for example from personal computers rather than work devices. It's also simple human things, like not having colleagues around us to double check whether something is legitimate," says Ingram.

Emotions = opportunity

During the lockdown period, scammers also preyed on people's emotions by attempting to extort social media passwords in order to access urgent information about the ever-evolving pandemic. 

"During the COVID-19 lockdown period, CERT NZ received steady reports of online criminals using the pandemic as an opportunity to carry out online scams and malicious cyber activity. While the number of reports directly related to COVID-19 were relatively low, we did see an overall increase in reporting for the second quarter of 2020," says Ingram. 

Andrew Hampton, Director-General of the Government Communications Security Bureau spoke recently to the New Zealand Institute of International Affairs at Victoria University of Wellington about managing cyber security in a COVID-19 world. Andrew said that cyber criminals adapted their techniques and tactics to match themes of the COVID-19 global emergency, opportunistically exploiting the public's desire for information and news about COVID-19 as a lure for the malicious activity. 

"According to Microsoft reporting by the end of March 2020, nearly every country in the world had at least one COVID-19-themed attempt to exploit computer users' desire for COVID-19-related information. 

"There have also been reports of health and pharmacuetical sectors being targeted and of state-actors using malicious cyber activity to promote narratives about the origins of the virus and their own, and other countries' response to it," Andrew says. 

Andrew notes many of these cyber security threats that have taken place since the emergence of COVID-19 are not new.