GCSB 'getting on top' of cyber attacks against NZX, other businesses, says Andrew Little

The Government Communications Security Bureau is getting on top of the cyber attacks that have seen the NZX website crash for the past five trading days.

GCSB Minister Andrew Little told Newstalk ZB's Mike Hosking the stock market has been getting advice from the GCSB since Tuesday last week, when the attacks started.

He said the NZX received an email message before the stock market was hit.

Work was under way to track the message's origin.

"The NZX got a message, an email before they got bombarded, so there's work going on tracking back where that might have come from," said Little, adding banks and a media outlet were also impacted by DDoS attacks on their systems.

Little said the GCSB was in a position of managing the continued attacks, rating it as 7/10 in terms of progress.

"The NZX contacted the National Cyber Security Centre which is part of the GCSB. They didn't want help originally but as it wore on last week they got help."

By Friday the GCSB stood up a serious group to deal with the ongoing attacks on the stock market.

Little said it appeared to be criminally motivated rather than a state-led attack.

"The nature of this tends to be criminal activity rather than state backed. You can't rule it out but it's more likely than not to be criminal activity."

The modus operandi with attacks on other organisations in recent days - such as banks and media companies - was the same, Little said.

He understands ransom has been sought in some cases but not others.

It also appeared to be a "pretty sophisticated" operation, he said.

On how long they would deal with the cyber barrage, he said "in the end you just have to withstand it and let it fizzle out".

It was a matter of time before those behind the attack would give up and go elsewhere if their demands went unmet, said Little.

The NZX website crashed again yesterday morning for the fifth day after a series of cyber attacks hit the exchange last week.

Despite this continued attack on its website, the NZX continued to trade all day uninterrupted.

The NZX, with the agreement of the Financial Markets Authority, has put in place alternative disclosure methods.

Prices were made available from the IRESS information provider and through the backbone of trading system Nasdaq X-Stream.

Last Friday, the Stock Exchange suffered its fourth day of offshore cyber attacks, overwhelming the NZX website.

Share trading was temporarily put on hold, because investors could not see up-to-date company announcements, leading to an uninformed market.

The ZDNet technology website said the cyber attacks had occurred around the world over the past two weeks, but the NZX was among the hardest hit.

Other financial service companies affected by the attacks include the global payments company, PayPal, and money transfer companies Braintree and Worldpay.

Media organisations RNZ and Stuff reported yesterday being subject to attacks.