{"id":55623,"date":"2026-03-12T03:54:43","date_gmt":"2026-03-12T03:54:43","guid":{"rendered":"https:\/\/employmenthero.com\/nz\/?post_type=news&p=55623"},"modified":"2026-03-12T03:54:45","modified_gmt":"2026-03-12T03:54:45","slug":"ai-hackers-cyber-security-risks-nz-businesses-smes-2026","status":"publish","type":"news","link":"https:\/\/employmenthero.com\/nz\/news\/ai-hackers-cyber-security-risks-nz-businesses-smes-2026\/","title":{"rendered":"Hackers Armed With AI Are Targeting NZ Businesses"},"content":{"rendered":"\n
\n
\n
\n
\n

New Zealand SMEs are being urged to make cyber security a top priority as hackers increasingly use AI to supercharge criminal activity.<\/p>\n\n\n\n

The 2026 Kordia New Zealand Business Cyber Security Report<\/a> has found the number of AI-related cyber attacks is soaring as new technology creates opportunities for more sophisticated breaches.<\/p>\n\n\n\n

Of 250 medium-to-large businesses surveyed, 44 per cent have reported falling victim to cyber crime in the past year. It has prompted a warning for businesses of all sizes to be aware of the risks, with the report declaring: \u201cEvery New Zealand organisation must treat cyber security as a strategic priority, not a cost centre, to safeguard economic stability and societal trust in the digital age.\u201d

For SME owners, the challenge is in protecting their businesses without the aid of an IT security team, and rolling out AI<\/a> without lowering barriers to entry for criminals.<\/p>\n\n\n\n

\u2018Shadow AI\u2019 Heightens The Risk Of A Cyber Attack<\/h2>\n\n\n\n

The prevalence of ungoverned AI use<\/a> within workplaces is creating a significant data risk for New Zealand businesses. 43 per cent of business leaders have told Kordia accidental data exposure via AI is their top concern, and with good reason, 14 per cent of reported hacks last year were the result of AI vulnerabilities, double the year before.<\/p>\n\n\n\n

\u201cInsider threats, whether accidental or malicious, have always been a factor in cyber incidents and data breaches,\u201d says Patrick Sharp, General Manager of Kordia-owned Aura Information Security<\/a>. \u201cBut \u2018shadow AI\u2019- the unauthorised use of AI tools by employees – is growing into a massive problem.\u00a0<\/p>\n\n\n\n

Individual staff members are copying confidential data into AI systems – information they would never put into Google – without understanding the risks and without guidance from their organisation.\u201d This includes tasks like drafting contracts or analysing financial spreadsheets.<\/p>\n\n\n\n

The awareness gap is mirrored in figures from the National Cyber Security Centre\u2019s SME Behaviour Tracker<\/a>, which found only 25 per cent of SMEs consider cyber security a high priority and only 50 per cent felt they were prepared for a cyber attack.<\/p>\n\n\n\n

The technical nature of breaches has also evolved. Rather than seeking backdoors through software vulnerabilities, attackers are increasingly focused on identity theft. “Attackers don’t hack in, they log on,” the report notes. <\/p>\n\n\n\n

Data from the NCSC shows 75 per cent of successful Business Email Compromise attacks – where criminals impersonate executives – bypass safeguards like SMS-based multi-factor authentication. Hackers use AI to automate the interception of credentials, then gain full access to business accounts, allowing them to redirect invoices and monitor private communications undetected.<\/p>\n\n\n\n

AI-generated Phishing Is Catching Out Alert Employees<\/h2>\n\n\n\n

AI has eliminated many of the \u2018tells\u2019 that savvy employees learned to recognise as phishing, where access is gained by someone clicking an email link. Kordia confirms 80 per cent of phishing material is now AI-generated, and without poor grammar or spelling has achieved a 54 per cent click-through rate, nearly five times higher than traditional phishing methods. <\/p>\n\n\n\n

In New Zealand, the NCSC 2025 Cyber Threat Report<\/a> warns that attackers are now deploying flawless te reo M\u0101ori in phishing campaigns to successfully exploit trust within the business community. Once in, personal information remains a key target for cyber criminals. 17 per cent of hacked businesses said personally identifiable information was accessed or stolen. A similar number, 21 per cent, worried about stolen data leading to blackmail or extortion.<\/p>\n\n\n\n

No SME Can Afford To Fall Victim To An Online Breach<\/strong><\/p>\n\n\n\n

While the overall number of cyber attacks in New Zealand fell last year – from 59 to 44 per cent of businesses – the cost per hack is rising. NCSC research<\/a> indicates the average cost of a data breach for a Kiwi SME is now $173,000. Q3 of last year saw a 118 per cent spike in direct financial losses, to a total of $12.4m.<\/p>\n\n\n\n

Beyond the immediate hit to the bank balance, the operational fallout can also be severe, particularly for smaller businesses with limited cashflow. The  Kordia data shows 61 per cent of businesses face major operational disruption after a breach, and face further costs in insurance premiums, legal fees and fines. Almost 1 in 10 victims received a ransom request and 42 per cent decided to pay. <\/p>\n\n\n\n

Take Steps To Move Beyond Traditional Safety Measures<\/h2>\n\n\n\n

To stay ahead of these evolving threats, experts suggest SMEs move beyond traditional checklists and adopt specific, high-impact security measures with more resilient frameworks. <\/p>\n\n\n\n