The Human Side of Cyber Security

Human Factors in Cyber Threats

New Zealand's cyber threat environment deteriorated noticeably through 2025. The National Cyber Security Centre documented 53% of small and medium enterprises experiencing threats in January to June, up from 36% the year before. State-sponsored groups, hacktivists tied to global conflicts, and ransomware operators commoditised via service models targeted organisations of all sizes, often via social engineering that leverages artificial intelligence for convincing personalised lures.

Nonprofit and charity organisations operate with particular vulnerabilities. Limited dedicated IT staff, high reliance on volunteers, and cultures built on trust leave them open to the human errors that feature in roughly 60% of breaches globally. They manage volumes of personal information on vulnerable populations and donors, where compromise can destroy public confidence essential for funding and operations. The March 2025 cyberattack on James Pascoe Group, owner of major retailers including Farmers and Whitcoulls, illustrates the immediacy: IT systems failed, forcing stores nationwide to cash-only trading and prompting a data-breach notification to the Privacy Commissioner.

Financial and regulatory stakes have sharpened. Direct losses reported to authorities reached NZ$26.9 million for the 2024-25 period amid broader annual cybercrime harm estimated at NZ$1.6 billion. The Privacy Amendment Act's IPP3A rule, effective 1 May 2026, requires organisations to notify individuals of indirect personal data collections, adding compliance layers shortly after awareness initiatives. Public-sector minimum cybersecurity standards, mandatory from October 2025, set benchmarks that charities ignore at governance risk, aligning with ACNC expectations for robust risk management in the not-for-profit sector.

Less discussed are the structural tensions. Nonprofit emphasis on openness and collaboration conflicts with security practices demanding suspicion of unsolicited contacts or regular simulations. Volunteer turnover undermines consistent training, while budget pressures pit mission-critical spending against preventive measures. Supply-chain dependencies amplify blind spots, as smaller entities rarely scrutinise third-party tools to the level now expected.