In August, a ransomware attack hit Zenith Technologies — ZenTech — a Dunedin IT company. If you scanned the headline at the time, it probably read like every other supplier breach: a company most people have never heard of, systems down, investigation under way.
Two months later, Stuff reported what that attack actually means. Coroners Court information was captured in the breach, coronial investigations have been delayed, and families are waiting — in one case many months — to learn how their mother died. The Ministry of Justice is working with Health New Zealand and police to establish what the captured information contains and how it came to be held by ZenTech at all.
Sit with that for a moment. The victims of this ransomware attack are not ZenTech's customers. They are people grieving a death, whose answers are locked behind someone else's incident response.
Ransomware's damage is measured in people, not servers
The security industry talks about ransomware in technical units: systems encrypted, days of downtime, records exposed. Those numbers are real, but they consistently hide where the harm actually lands — two or three steps downstream, on people who never chose the breached company, never signed its terms, and in many cases never knew it existed.
We saw the same shape when a US ransomware attack stopped Coca-Cola's milk production lines — the harm landed on farmers and retailers. We saw it when ManageMyHealth was breached — the harm landed on patients. In the ZenTech case the downstream parties are about as far from a cyber security decision as it is possible to be: bereaved families dealing with the coronial system.
For a business audience, this reframes a question most risk assessments get wrong. The question is not "what would an attack cost US?" It is "who, downstream of us, inherits the damage?" If your business processes data or provides services for other organisations, your incident is their incident — and their customers' incident.
The duty-of-care chain
Legally, New Zealand organisations owe obligations under the Privacy Act 2020 to the people whose information they hold — regardless of how that information arrived. Operationally, most SMEs have never mapped who those people actually are. A bookkeeping firm holds the payroll details of its clients' staff. A specialist IT provider, like ZenTech, can end up holding sensitive government records. A marketing agency holds its clients' entire customer lists.
Three questions worth answering while this story is in the news:
- Whose people are in your systems? Not your customers — your customers' customers, staff, patients, members. List the categories. The list is usually longer and more sensitive than anyone expects.
- Would those people's organisations find out from you, or from a journalist? Your notification plan should include your clients within hours, not after your lawyers have perfected a statement. We cover the mechanics in what to do when a supplier is claimed as breached — and if you are the supplier, that playbook runs in reverse.
- Could you keep delivering if your systems were gone for two months? The coronial delays show what service interruption does when the service is one people cannot route around. The recovery-first thinking in ransomware and the first 24 hours exists for exactly this.
What this means for prevention
Here is the uncomfortable arithmetic: the control that most often fails first in ransomware incidents is a person — a credential phished, an attachment opened, a login reused. When your business holds other people's people in its systems, every one of your staff is effectively guarding strangers who will never know their names. That is not a burden most employees have ever had framed for them — and in our experience, framing it changes behaviour more than any compliance slide ever has.
Train your team like the downstream families are real. Because, as Dunedin is currently demonstrating, they are.
SecureAZ trains NZ and Australian teams with short, local, human scenarios — and phishing simulations that find the gaps before an attacker does. Start a free 45-day trial.