As trading opened this morning, the NZX website was up, but displaying blanks instead of stock prices.
It seemed the issue was affecting the NZX.com website only, with the exchange's trading platform still operational (with A2 taking a heavy hit, according to Bloomberg).
The exchange could not immediately explain what was going on. The explanation eventually emerged after 3pm.
The NZX came under a sustained DDoS (distributed denial of service) attack over the week from August 28, with the exchange drafting in multinational content delivery network Akamai and the GCSB to beef up its defences.
On Friday, ex RAF security expert Jeremy Jones told the Herald it was very likely "just a bunch of kids in Ukraine or Eastern Europe" who were hiring a bot net by the hour.
Jones says a state actor, or organised crime cyber-gang, would have deployed a ransomware attack that could would have given the attackers control of the NZX's data until it paid up - or spent weeks rebuilding its systems.
Instead, they unleashed a DDoS (distributed denial of service) attack to send a flood of connection requests to the NZX's website, rendering it inaccessible to regular users.
The attack was never going to damage any NZX systems or seize any of its data, and it was only a matter of time before the exchange marshalled sufficient defences (in the final event, it brought in the multi-national Akamai, and created a second website for market announcements. The GCSB was also in the frame).
Jones says the attackers probably did make a financial demand realised early on that they had no chance of being paid. He thinks they carried on attacking the NZX for several days regardless purely in a fit of pique.
The pique extended to DDoS attacks on companies listed on the NZX, as Jones learned as several of Theta's clients were hit. "They were going through the list, one by one," he says. It was all for nought, however, with the attacks easily repelled.
