The Weekly
Brief

A new half-year threat report from Gen (the security firm behind Norton and Avast), covered by IT Brief NZ on 17 July, shows the scam wave hitting New Zealand hasn't let up in 2026 — it's shifting shape. Locally, fake online-shop (e-shop) scams jumped 87%, tech-support scams rose 27%, and so-called "scam-yourself" attacks — where the victim is talked into doing the attacker's work for them — climbed 45%.

The one worth flagging to staff: malicious remote-access incidents in NZ were up 73%. That's the classic trap where a caller "from Microsoft" or "your bank" persuades someone to install a remote-support app or paste a command — handing over the keys without a single password being stolen. Gen's team notes AI is making the messages cleaner, more personal and harder to pick.

On 14 July, SonicWall disclosed two vulnerabilities in its SMA1000 secure remote-access appliances — and confirmed both are already being exploited in real-world (zero-day) attacks, chained together. The headline flaw, CVE-2026-15409, scores a maximum CVSS 10.0: it's a server-side request forgery bug that a remote, unauthenticated attacker can trigger — no login, no valid account needed. The second, CVE-2026-15410 (CVSS 7.2), lets an authenticated admin run operating-system commands on the box.

Affected models are the SMA 6210, 7210 and 8200v. SonicWall says there is no workaround — you must update to a fixed build (12.4.3-03453 or 12.5.0-02835 and later). US federal agencies were ordered to patch or pull these devices offline by 17 July, which tells you how seriously the threat is being taken.

As of 1 July, Microsoft has made its "Microsoft 365 Business with Copilot" plans generally available — turning what had been a run of temporary promotions into permanent products a business can plan around. In Microsoft's own words, these SKUs "turn a successful promotional motion into a permanent, predictable offer you can build your business around."

The new bundles fold the Copilot AI assistant straight into the familiar plans: Business Standard with Copilot at US$23.50 per user/month and Business Premium with Copilot at US$32 (annual, up to 300 seats). Copilot Business also stays available as a standalone add-on from US$18 per user/month. Note the pricing is Microsoft's partner/USD list — New Zealand businesses buy through a local reseller, so your NZD price will differ.

New Zealand's health sector has just weathered three serious data breaches in a row — the patient portal Manage My Health (hundreds of thousands of medical files stolen), MediMap, and diagnostics provider IntraCare. In its first-quarter report, the NCSC recorded three "highly significant" incidents — the most severe category, and the first of that kind since 2021/22.

The accountability is now landing. The Privacy Commissioner found that Health NZ and Manage My Health — as reported by RNZ — "failed in their responsibilities" to have adequate security controls in place. It's a pointed signal: when data goes missing, the regulator is increasingly willing to say plainly whose job it was to protect it.