Quick answer
A cyber attack on a small New Zealand business costs cash in three ways: money lost directly (often a redirected payment), trading days lost while systems are rebuilt, and recovery bills for IT help and new hardware. The fix is to plan now: tested backups, two-factor sign-in, a call-back rule for bank changes, and an offline folder of the documents a lender needs, so funding isn't slowed if it happens.
Key points
- Most of the cash damage comes from lost trading days and recovery work, not the ransom note.
- Payment redirection and email account takeovers are where many owners lose money directly.
- The Privacy Commissioner wants notifiable breaches reported, ideally within 72 hours.
- IRD still expects records kept for at least seven tax years, and GST and PAYE dates don't move.
- Keep an offline copy of bank statements, returns and ID so a lender can move in hours, not days.
Picture Monday morning. The accounts laptop shows a ransom note, the shared drive is scrambled, and a supplier has just phoned to ask why last week’s payment never arrived. The bank details on “their” invoice were changed by someone who had been quietly reading your email for a month.
Most owners treat cyber security as an IT problem. In practice it shows up as a cash problem, and usually at the worst time: GST due, wages on Wednesday, and no way to send invoices. This guide covers what an attack really costs a small New Zealand business, what has to happen in the first 72 hours, and the one folder that keeps funding fast if you ever need it.
How common are cyber attacks on New Zealand businesses?
Common enough to plan for. The National Cyber Security Centre’s Quarter Two 2026 insights report logged 1,129 incident reports between April and June 2026, with $2.7 million in reported direct financial loss. Two details stand out for business owners:
- A small number of incidents do most of the damage. Just 49 reports of $10,000 or more made up $2.4 million of that loss, about 91%.
- Unauthorised access was the biggest earner for criminals. Someone getting into an account (usually email) was behind roughly $1.3 million, around half the quarter’s total.
Those are only the incidents people chose to report, so the real number is higher. And direct loss is only the first line of the bill.
What does a cyber attack actually cost a small business?
Think of the cost in three layers. The first is obvious; the other two catch people out.
| Cost layer | What it looks like | When the cash goes |
|---|---|---|
| Money taken | A customer pays a fake account, or you pay a “supplier” whose bank details were swapped | Instantly, and often unrecoverable once it’s moved on |
| Trading lost | No invoicing, no online orders, no booking system, staff paid to wait | Every day systems are down, plus a slower month of collections after |
| Recovery bills | IT specialists, new laptops, software rebuilds, legal advice, customer notices | Usually within the first two weeks, often on short payment terms |
| Knock-on costs | Late GST or PAYE, missed supplier discounts, overtime to catch up | Over the next one to three months |
The trading layer is the one that drains a cash-flow forecast. A hospitality business that can’t take bookings, or a trade business that can’t invoice for a fortnight, keeps paying wages and rent while the money coming in stalls. That’s exactly the gap a business line of credit is meant to cover, but only if it’s already open or quick to arrange.
What has to happen in the first 72 hours?
Hours matter here, for both the money and the rules. A practical order:
Hour 0–2: contain it. Disconnect affected devices from the network (don’t wipe them, as evidence matters). Change passwords for email and banking from a clean device, and turn on two-factor sign-in if it wasn’t on.
Hour 2–6: protect the money. Ring your bank’s fraud team if any payment has gone to the wrong account; speed is everything for any chance of recovery. Phone, rather than email, your key customers and suppliers to tell them not to act on any bank account change from you.
Hour 6–24: report and get help. Report the incident to the NCSC through its reporting tool. It can help you work out what to do next. Ransomware and fraud are crimes, so report to Police too. Call your insurer if you hold cyber cover; many policies require early notice and have their own response team.
Hour 24–72: the privacy question. If customer or staff information may have been accessed, work through whether serious harm is likely. The Office of the Privacy Commissioner says to notify it about a notifiable breach ideally within 72 hours of becoming aware, “even if you’re still investigating”, and to tell affected people as soon as you can.
Same 72 hours: the cash check. Rebuild a simple forecast for the next eight weeks. When is the next wage run, the next GST or PAYE payment, the next big supplier bill? If the running balance dips below zero, you want to know on day two, not day twenty.
If that forecast shows a hole, see what you could access in about a minute, and mention it’s an attack recovery so we know which documents to ask for first.
Do IRD deadlines move after a cyber attack?
No, not on their own. GST, PAYE and provisional tax dates stay where they are, whether or not your accounting software is up. Two things are worth knowing.
First, records. Inland Revenue says to keep all business records, “including those in electronic form”, for at least 7 tax years. Encrypted files you can’t open aren’t much use, which is one more reason to keep a tested backup somewhere the attacker can’t reach.
Second, payment. If the attack means you can’t pay on time, contact Inland Revenue before the due date and ask about an instalment arrangement. Penalties and use-of-money interest can still build while you pay it off. Our guide to what paying IRD late really costs shows how to weigh that against a short-term loan.
Why does a cyber attack slow down business finance?
Because the documents a lender reads are often sitting in the systems that just went down. A fast application normally rests on:
- six months of business bank statements;
- photo ID for each director or owner;
- your most recent financial statements or tax returns;
- recent GST returns, plus aged debtors and creditors for larger amounts;
- property details (Record of Title, rates notice) if the loan is secured.
When the accounting file is encrypted, the shared drive is gone and your email can’t be trusted, gathering that pack can take days. On top of that, a lender will reasonably ask how the business is trading now, so a clear, honest explanation of the attack and your recovery plan matters. Our page on what slows funding covers the other usual hold-ups.
What should go in an offline “break-glass” funding folder?
Build it this week, while everything works. Keep it on an encrypted USB stick or in a separate cloud account with its own password and two-factor sign-in, not on your main network.
| Item | Why a lender wants it | How often to refresh |
|---|---|---|
| Last six months of bank statements (PDF) | The core of any cash flow or unsecured decision | Monthly |
| Latest annual accounts and income tax return | Shows the business before the attack | Each year once filed |
| Last two GST returns | Confirms turnover and that IRD is up to date | Each GST period |
| Driver licence or passport for each owner | Identity checks | When renewed |
| Record of Title and rates notice (if secured) | Speeds up property security and valuation | Yearly |
| Key contacts: accountant, lawyer, IT support, insurer | Saves an hour of hunting on a bad day | When anything changes |
| Loan, lease and equipment finance statements | Shows existing commitments and any PPSR registrations | Quarterly |
Our documents checklist sets out what each loan type needs, so you can tailor the folder.
Which finance suits a cyber attack recovery?
Match it to the shape of the hole.
- Wages due and invoicing frozen. A line of credit or a short cash flow loan, sized on turnover and bank statements. Unsecured options typically run from $5k to $500k. If payroll is days away, start with our payroll-due checklist.
- Replacing laptops, servers or point-of-sale gear. Equipment funding or a small loan. New assets may qualify for Investment Boost, so check with your accountant.
- A large hit, such as a big redirected payment. A property-secured business loan from $20k to $5m, over residential or commercial property. $20k to $250k is possible same day; up to $5m is possible within 24 to 48 hours with a clean title and documents ready.
Past credit issues and IRD debt are looked at case by case, and all lending is for business purposes.
A worked example from Palmerston North
(Illustrative only.) A small engineering workshop opens its email on a Tuesday to find that a customer paid a $62k invoice into a fraudulent account two days earlier. The attacker had been in the office manager’s mailbox for weeks.
- Tuesday morning: passwords reset from a clean phone, two-factor turned on, the bank’s fraud team called. The customer is phoned and agrees the business still needs to chase the money with its own bank.
- Tuesday afternoon: incident reported to the NCSC and Police; insurer notified. The workshop works out whether any personal information was exposed.
- Wednesday: the owner’s offline folder has six months of statements, last year’s accounts and both directors’ IDs. The forecast shows wages and the 28th GST payment can’t both be met.
- Thursday: a cash flow loan sized on bank statements is approved and funded. Wages and GST go out on time, and the loan is cleared over the following months as invoices are paid.
The folder didn’t stop the attack. It meant the loan application took an afternoon instead of a week.
A cyber attack is a cash event. Be ready for the cash part
Good backups and two-factor sign-in protect your data. What protects the business is knowing the money is there if invoicing stops for a fortnight. If you’d like to know where you stand before anything goes wrong, or you’re dealing with an attack right now, that’s a conversation we have often.
Start your enquiry. It’s about 60 seconds, and there’s no credit check when you first enquire. We won’t send your details to a pile of lenders, so you won’t be flooded with calls from people you’ve never heard of. One real person reads your enquiry, looks at your situation, and calls you back.
Please answer the form accurately: your turnover, the amount you need, when the gap opens and whether property is available. Clear answers let us line up the right option first time, which is how 24 hours becomes possible.
Frequently asked questions
Should a New Zealand business pay a ransomware demand?
The New Zealand government's advice is not to pay. Payment doesn't guarantee you'll get your data back, and it may even breach sanctions. If you're even considering it, get independent legal and specialist advice first, and report the attack to the NCSC and Police.
Who do I report a cyber attack to in New Zealand?
Report the incident to the National Cyber Security Centre through its online reporting tool, which also helps you work out next steps. Ransomware and fraud are crimes, so report to Police as well. If personal information about customers or staff may have been exposed, assess whether you need to notify the Privacy Commissioner.
Do I have to tell the Privacy Commissioner about a cyber attack?
If the breach has caused, or is likely to cause, serious harm to the people whose information was involved, it's a notifiable privacy breach. The Office of the Privacy Commissioner says to notify ideally within 72 hours of becoming aware, even while you're still investigating, and to tell affected people as soon as you can.
Can I still get a business loan if my accounting system is down?
Often, yes. Lenders mainly want recent bank statements, ID, and your latest financials or returns. Your bank's online statements usually sit outside your own systems, so you can download them from a clean device. An offline copy of your last returns and ID makes this far quicker.
Will IRD give me more time to pay GST after a cyber attack?
Your due dates don't move automatically. If you can't pay on time, contact Inland Revenue before the due date and ask about an instalment arrangement. Penalties and use-of-money interest can still apply, so compare that cost against short-term finance.
How fast could finance arrive if an attack leaves a cash gap?
Smaller unsecured amounts can sometimes be funded the same day. Property-secured amounts from $20k to $250k are possible same day, and up to $5m is possible within 24 to 48 hours, when the paperwork is ready and the title is clean. Our aim is to have you funded within 24 hours of your first application.
