In December 2022, ransomware hit Mercury IT, a Wellington managed service provider. Among the consequences: roughly 14,500 coronial transport files and around 4,000 post-mortem reports became inaccessible, the Ministry of Justice could not rule out data theft, and the Privacy Commissioner opened an investigation.
In August 2026, ransomware hit ZenTech, a Dunedin IT company. Among the consequences: Coroners Court information captured, coronial investigations delayed, and families waiting months for findings about how their relatives died.
Four years. Different city, different supplier, different attacker. Functionally the same incident, down to the specific category of harmed bystander. When the same event recurs with that precision, the interesting question stops being "what happened?" and becomes "what didn't change?"
What didn't change
1. Small suppliers still hold outsized data. Both incidents involved modest IT firms holding some of the most sensitive records the state produces. That concentration is not an accident — it is the economics of outsourcing. Specialist suppliers accumulate many clients' crown jewels while running security budgets sized for their own headcount. Attackers worked this out years ago: one mid-sized supplier yields dozens of organisations' data for the effort of breaching one, the exact leverage we described in supply chain attacks through vendors.
2. Due diligence still happens at contract signing, then stops. Suppliers get their security questionnaire at procurement and rarely again. Mercury IT to ZenTech is a four-year gap — plenty of time for a supplier assessed as adequate to drift into inadequacy as staff turn over, systems age and client data accumulates. Annual re-verification of critical suppliers remains rare in NZ, and the absence shows.
3. Continuity planning still assumes the supplier's recovery is quick. Both incidents produced service outages measured in months, not days. The coronial delays in 2026 mirror the inaccessible files of 2022: dependent organisations had no workable operating mode for "our supplier is down indefinitely." If your business runs on a specialist platform, your plan for that platform disappearing for a quarter is probably a shrug — the gap we pushed on in the supplier-claim playbook.
4. The entry points have not changed either. Ransomware operators still overwhelmingly arrive through phished credentials, exposed remote access and unpatched perimeters — the same doors as 2022, now found faster by AI-assisted reconnaissance. The defences are correspondingly unchanged and correspondingly unimplemented: MFA everywhere, aggressive perimeter patching, tested offline backups, and staff who do not hand over the first credential — the fundamentals in our ransomware data review for NZ.
Breaking the cycle, SME edition
If you are a business that DEPENDS on suppliers:
- Re-verify your critical suppliers annually, not just at signing — one email: what has changed in your security posture, staffing and certifications this year?
- Contract for incident response: notification within 48 hours, response to public claims, data return/destruction on exit
- Write the "supplier down for 90 days" page of your continuity plan — the ZenTech timeline says 30 days is optimistic
If you ARE the supplier:
- You are the concentration risk. Your clients' regulators, customers and — as both these incidents show — bereaved families stand behind your decisions
- The controls that stop you becoming the next headline are unglamorous: MFA on everything, patching discipline, tested offline backups, and trained staff
- Your sales argument is sitting in the news: demonstrable security is now how small NZ suppliers win government and enterprise work
The four-year test
Here is the question that matters for 2030: will the next supplier ransomware story read any differently? For the country, that depends on procurement and regulation. For your business, it depends on whether this fortnight's news produces a supplier review, a continuity page, and a trained team — or just a grimace and a scroll.
The people layer is the part you can fix this quarter. SecureAZ trains NZ and Australian teams on exactly the entry points these attacks keep using — free for 45 days, up to 5 users.