Abstract security statistics don't convey what a cyber incident feels like for a small business owner. These three composite scenarios — drawn from the pattern of real NZ incidents — show the human and financial reality of what happens when security gaps are exploited.
The following scenarios are composites based on the patterns of real incidents reported to CERT NZ and seen in Optimyze's incident response work. They're representative of the types of incidents that affect NZ small businesses most frequently — not the dramatic nation-state attacks that make international news, but the quieter, more expensive events that happen to ordinary businesses every week.
Scenario 1: The Accountant's Email Account
A bookkeeper at a 15-person Auckland professional services firm clicked a phishing link that captured her Microsoft 365 credentials. The attacker logged into her email account at 11pm and spent the next three days reading correspondence — learning client names, payment amounts, and the firm's processes. On the fourth day, they sent an email from her account to a client, explaining that the firm had changed banking details and asking that the next invoice payment go to a new account. The client paid $31,000 to the attacker's account.
Total loss: $31,000 (partial recovery of $8,000 via bank recall). Six weeks of reputation management. One client relationship ended. The attacker was in the email account for four days before acting — four days during which an alert on impossible-travel sign-in or anomalous login location would have triggered remediation.
What would have stopped it: MFA on the Microsoft 365 account (the phished password would have been worthless). Conditional Access blocking sign-in from Eastern Europe. Any unusual sign-in alert. Payment verification policy requiring verbal confirmation. Cost to implement all four: approximately $50/month as part of a managed IT service.
Scenario 2: The Ransomware Weekend
A Nelson manufacturing business came in on Monday morning to find every computer encrypted. Ransomware had been deployed over the weekend — it had entered the environment 12 days earlier via an unpatched vulnerability in the business's remote desktop server. During those 12 days, the attacker had mapped the network, found the backup server, and encrypted the backup drive along with everything else. The ransom demand was $85,000 NZD.
Total loss: $85,000 ransom paid (no guarantee of decryption — key delivered but some file types didn't decrypt cleanly, requiring partial rebuild anyway). $22,000 in IT rebuild costs. Three weeks of partial operation. One significant customer contract lost due to delivery failures during downtime.
What would have stopped it: Patching the RDP vulnerability (patch had been available for 47 days). Not exposing RDP directly to the internet. Immutable backup (the backup was encrypted because it was on the same network). EDR detecting the pre-ransomware lateral movement. Any one of these controls would have changed the outcome.
Scenario 3: The Quiet Exfiltration
A Wellington legal firm discovered seven months after the fact that a former staff member — who had resigned — had spent their final two weeks at the firm downloading client files to a personal Dropbox account. The files included client correspondence, trust account records, and confidential matter documents for approximately 40 client matters. The discovery happened when a client informed the firm they'd been approached by a competitor with detailed knowledge of their matter.
Total loss: Legal costs of Privacy Commissioner engagement ($18,000). Notification costs for affected clients. Three client relationships ended. Law Society complaint lodged. Ongoing reputational impact.
What would have stopped it: DLP (Data Loss Prevention) policies preventing upload to personal cloud storage. Access review removing the resigning employee's broad file access during their notice period. Offboarding checklist that included revoking access on the last day rather than the Friday after they left.
In each of these scenarios, the organisation knew about the security control that would have changed the outcome — it just hadn't been implemented. The cost of the controls is measured in hundreds of dollars per month. The cost of the incidents is measured in tens of thousands.
