New Tool Reveals How Vulnerable Kiwis Are Online: National Cyber Security Centre Launches ‘How Exposed Am I’

Auckland, New Zealand: The National Cyber Security Centre (NCSC) has revealed a staggering figure: Over 4.3 million New Zealand account details have been exposed online.

This Cyber Smart Week, NCSC is launching ‘How Exposed Am I’, through its Own Your Online platform. The free digital tool which sources data from the Have I Been Pwned service, shows Kiwis personal information that has been exposed and leaked online, and helps them take protective action against scammers, giving them back control of their online security.

Information exposed on the internet is easy for scammers to access and can make accounts more susceptible to compromise.

The urgency is real:

• Recent research indicates that more than half (54%) of New Zealanders faced an online security threat over a six-month period.
• Yet, only 42% of New Zealanders feel personally vulnerable to online threats.
• It is estimated that New Zealanders lost NZ$1.6 billion to online threats in 2024.
• Over 830,000 New Zealanders had experienced some financial loss, with the average amount lost per attack being $1,260.
• The majority (88%) of those affected felt the incident's impact (moderate, significant, or severe).

Mike Jagusch, Director of Mission Enablement at the NCSC, illustrates the scale of the challenge facing New Zealanders in protecting their digital identities.

“Almost everyone carries a digital footprint, and with it, a level of exposure to scammers. The real difference between being scammed, or not, lies in how effectively we protect ourselves. The latest statistics highlight the increasing prevalence of cyber crime and the urgent need for proactive measures. Even the simplest cyber security actions like two-factor authentication and long, unique passwords can significantly reduce exposure and risk of an attack. Two-factor authentication alone can help stop 99% of automated online attacks and long, unique passwords can take billions of years to crack,” Jagusch added.

This initiative forms part of Own Your Online’s ongoing commitment to support New Zealanders to be more secure online. The ‘How Exposed Am I’ tool has already highlighted confronting realities for early users, with many surprised to learn the extent of their exposure online and just how far their personal information had spread.

Own Your Online is calling for Kiwis to bolster their security position through two key steps. Create long, unique passwords and turn on two-factor authentication (2FA) on your main accounts, beginning with the most crucial ones including bank, email, and social media, for an essential layer of protection.

Head to www.howexposedami.co.nz to check your exposure score and find out more.

About National Cyber Security Centre and Own Your Online

The National Cyber Security Centre (NCSC) provides cyber security services to all New Zealanders. Through the NCSC brand Own Your Online, we help New Zealanders and small-to-medium businesses understand the importance of being secure online and taking proactive action to protect themselves.

Own Your Online is part of the New Zealand Government’s work to raise the understanding of cyber security issues for individuals and small-to-medium businesses. It’s a space where people can quickly get the information they need in plain language.

About Cyber Smart Week

Own Your Online runs Cyber Smart Week every year, focusing on raising the importance of cyber security and encouraging everyday New Zealanders and small-to-medium businesses to be more secure and resilient online.

This year, Cyber Smart Week will run from Monday, 6 October to Sunday, 12 October.

About ‘How Exposed Am I’ tool

This is an innovative tool designed to help New Zealanders understand their own personal risk of to being scammed online. Users enter their own email address, which is indexed against 75,000,000,000 different *data points found in real-world public information leaks that scammers could have access to. It’s arresting. It’s hyper-personal. And will leave you feeling surprised and confronted.

*A data point is a piece of personal information exposed in a breach. As an example, if a data breach contains 1M email addresses and 1M passwords, that would result in 2M data points.

About Hero Statistic

The data was sourced from the Have I Been Pwned service by searching their database for accounts ending with .nz.

HIBP is a free resource for anyone to quickly assess if an online account of theirs has been compromised or "pwned" in an information leak. When data breaches are made publicly available online, their contents are added to the HIBP database for users to query.

HIBP has been running since 2013, but the earliest included information leak date is 2007, meaning that our data may go back as early as 2007.

Because this data only includes leaks that have been made publicly available, and because New Zealanders will have accounts that do not end with .nz (for example, gmail.com accounts), this value of 4.3 million is the minimum estimate for New Zealand account details that have been exposed.

© Scoop Media