Privacy Week: Sensitive information stored online can hurt you
You might be surprised to know that a considerable amount of your most sensitive information is has been filed away in the cloud by the companies and government departments you deal with your medical records, private conversations you've had with others, financial information, purchases you've made and more.
This kind of data is routinely accessed by cybercriminals. In fact, it's possible some of your sensitive data is available on the dark web right now.
It all comes down to what information you share with organisations and how they protect it. Do they take their role as guardian of your data seriously?
The sad reality is, we live in a country where many businesses don't. And even the companies that do take cyber security seriously can't guarantee your data will be safe from a cyber-attack.
As Privacy Week 2025 begins, it's a good reminder for you to be careful with the information you share, and who you share it with.
The truth is, in the modern world you often have no choice but to share personal information. You may be able to limit what you share on social media or the number of online accounts you sign up to, but it's a lot more difficult to control how organisations store your essential records like your medical data or financial information.
Privacy Week should really be less about individuals, and more about business leaders considering the data they hold and what they are doing to ensure it's protected.
The personal impact of a cyber breach
When personal data is leaked, depending how sensitive the information is, it can cause significant harm to victims. However, cybercriminals don't care about the damaged caused to individuals. For them, personal data is a valuable bargaining chip to force the companies they hack into paying an extortion demand.
In February this year Genea Fertility in Australia was breached with up to 700GB of data stolen and listed on the dark web.
It was reported that contact details, Medicare card numbers, medical histories, test results, and medications were compromised, although Genea is yet to confirm this.
Genea's silence has only deepened the anxiety, adding stress and turmoil to what is already a deeply personal and emotional fertility journey.
There are also growing international trends of cybercriminals blackmailing individuals. This can profoundly impact wellbeing and have harrowing consequences. Take the case of Swedish psychotherapy provider Vastaamo whose databases containing confidential mental health information were breached in 2020.
When the company refused to pay the ransom demand, the hacker emailed thousands of patients asking for 200 Euros and threatening to publicly share their personal details.
At least one suicide has been linked to the case, a devasting outcome of what can happen when private data is weaponised.
It's about the stick
So, what's going to get New Zealand businesses to take cyber security seriously? I think it's more about the stick than the carrot.
In 2016, company directors became personally liable for health and safety negligence. This prompted a significant rise in due diligence and New Zealanders were better protected at work.
Protecting personal data should be treated in the same regard as health and safety.
At the very least, we need to look at the fines the government can issue to businesses hit by cyber-attacks.
Currently in New Zealand, the maximum fine that can be issued is $10,000, and that's for not disclosing a data breach to the Privacy Commissioner. Compare that to Australia where their maximum fine for serious interference with privacy is $50 million.
That's an incentive that would really get business leaders to take their responsibility seriously.
What can individuals do?
New Zealand legislation won't change overnight, but we should continue to put pressure on organisations collecting data to uphold our privacy.
However, protecting yourself online can help you avoid, or better manage your affairs, if your personal or financial details are breached.
Here are four basic tips: Never save your credit card details
Sure, it's nice to have your credit card details saved into your browser, but it's not worth the risk. If your device or the shopping site is compromised, a hacker can easily steal your credentials and fraudulently charge your cards. Always use multi-factor authentication (MFA)
Having to get your phone out each time you log in to an important app or website to verify yourself is a hassle, but it's one of the best ways to lock hackers out.
It is easy to ignore device updates to your phone or computer, but you should install them as soon as they're available. Secure your most used apps.
There are a range of built-in privacy tools from WhatsApp, Facebook, and Google that allow you to review and tighten your security settings. Be sure to do this! You might be surprised how much information can be scraped from public profiles. Only share what you need to.
Limit what information you share online, whether that be on social media or through surveys, online forms, competitions or other mechanisms companies use to collect personal data. Only share what is necessary.
My parting advice is to remember your private data is valuable, especially to cybercriminals.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
05-08-2025
- Techday NZ
Phishing kits & AI drive surge in email attacks on firms
VIPRE Security Group has released its Q2 2025 Email Threat Landscape Report, presenting findings based on its continuous monitoring and analysis of global cybersecurity trends. Phishing kits dominate attacks The report indicates that 58% of phishing sites now use unidentifiable phishing kits. These kits are increasingly customised or obfuscated, making them very difficult for defenders to detect or analyse, and often leveraging artificial intelligence to reduce costs. Notable kits cited include Evilginx (20%), Tycoon 2FA (10%), 16shop (7%), with a further 5% attributed to other generic offerings. Such phishing kits are described as untraceable, with the report stating that they "can't easily be reverse-engineered, tracked, or caught." This trend underscores a shift toward more sophisticated and hard-to-combat forms of phishing campaigns. Manufacturing sector remains primary target For the sixth consecutive quarter, the manufacturing sector continues to be the most targeted industry for email-based cyberattacks, accounting for 26% of all reported incidents. These attacks include business email compromise (BEC), phishing, and malspam. The retail sector follows at 20%, with healthcare comprising 19% of recorded attacks for Q2 2025. VIPRE notes that this distribution aligns with trends identified over the previous year. Scandinavia targeted by BEC schemes The report reveals a marked increase in BEC attacks targeting Scandinavian executives. While English-speaking executives still represent the largest group targeted by BEC emails (42%), a substantial portion target Danish (38%), with Swedish and Norwegian executives representing a combined 19%. Language and localisation in attack emails are on the rise. Danish is used in 11.9% of BEC scam attempts, Swedish in 3.8%, and Norwegian in 1.5%. The report attributes the targeting of native languages to the fact that many corporate communications, particularly in HR, finance, and executive functions, still take place in local tongues despite high English proficiency in the region. Impersonation remains the main BEC tactic, with 82% of scams involving the impersonation of CEOs and executives. Directors and managers account for a further 9%, HR staff for 4%, IT staff for 3%, and school heads for 2%. Lumma Stealer observed as top malware Lumma Stealer has become the most observed malware family during Q2 2025, the report states. It is typically delivered via malicious .docx, .html, or .pdf attachments, or through phishing links hosted on services such as OneDrive and Google Drive. The malware's accessibility stems from its availability as "Malware-as-a-Service" (MaaS), benefiting from active development support and competitive pricing. This broadens its appeal to both experienced and novice cybercriminals. Bait and persuasion techniques Financial incentives were the most common lure in malicious emails, accounting for 35% of samples. Messages feigning urgency comprised the second most frequent tactic at 25%, followed by account verification and update requests (20%), travel-related themes (10%), package delivery notifications (5%), and legal or HR notices (5%). Cybercriminals continued to use open redirect mechanisms for phishing, with 54% of attacks masking malicious destinations via links on marketing, tracking, or even security platforms. Compromised websites delivered 30% of phishing links, and URL shorteners were used in 7% of incidents. PDFs remain the dominant file format for malicious attachments at 64%, with a rising proportion now containing embedded QR codes to facilitate attacks. Exploitation mechanisms after delivery In the final stage of attacks, cybercriminals rely on exploitation mechanisms such as HTTP POST to remote servers, accounting for 52% of observed cases, with email exfiltration reported in 30%. "It's clear what the threat actors are doing – they are outsmarting humans through hyper-personalised phishing techniques using the full capability of AI and deploying at scale," Usman Choudhary, Chief Product and Technology Officer, VIPRE Security Group, says. "Organisations can no longer rely on standard cybersecurity processes, techniques, and technology. They need comprehensive and advanced email security solutions that can help them to deploy like-for-like defenses – at the very least – if not help them stay a step ahead of the tactics used by cybercriminals." The report draws on intelligence gathered by VIPRE Antivirus Lab through continual analysis of email threats.
NZ Herald
01-08-2025
- NZ Herald
Sweden jihadist jailed for life after Jordan pilot burned alive
A Stockholm court has handed down a life term to Swedish jihadist Osama Krayem over the 2015 murder of a Jordanian pilot burned alive by the Islamic State group in Syria. The Swedish court was the first to try a person over the killing that sparked outrage around the world.
NZ Herald
31-07-2025
- NZ Herald
Verdict due in Sweden over Jordanian pilot burned alive
A Palestinian man holds a candle and portrait of slain Jordanian pilot, Lieutenant Maaz al-Kassasbeh, killed by Isis, during a candlelight vigil in 2015 outside the Nativity Church. Photo / Getty Images Listening to articles is free for open-access content—explore other articles or learn more about text-to-speech. A Palestinian man holds a candle and portrait of slain Jordanian pilot, Lieutenant Maaz al-Kassasbeh, killed by Isis, during a candlelight vigil in 2015 outside the Nativity Church. Photo / Getty Images A Stockholm court was to hand down a verdict tonight NZT in a Swedish jihadist's trial over the murder of a Jordanian pilot burned alive by Isis in Syria. The Swedish court is the first to try a person over the killing, which sparked an international outcry in 2015. It is due to deliver a verdict at 9pm NZT. On December 24, 2014, an aircraft belonging to the Royal Jordanian Air Force crashed in Syria. The pilot, Maaz al-Kassasbeh, was captured the same day by Isis fighters near the central city of Raqqa and was burned alive in a cage sometime before February 3, 2015, when a video of the gruesome killing was published, according to the prosecution. Prosecutors have been unable to determine the exact date of the murder but the investigation has identified the location.
