AUD $2.5 million. That’s the fine an Australian firm copped in February – not for getting hacked, but for not spending enough on security before it happened.
Across the ditch, cyber has become a director problem. In New Zealand we’re a step behind – but heading the same way.
What happened in Australia
In February 2026 the Federal Court fined Australian financial services firm FIIG Securities AUD $2.5 million. The company had suffered a cyber-attack that exposed the personal data of around 18,000 clients – drivers’ licences, passports, bank and tax details, later dumped on the dark web. The penalty wasn’t for the breach itself. It was for years of underinvestment in security before it happened. The judge called it “a warning to businesses with inappropriate underinvestment in cybersecurity”.
Where New Zealand is heading
NZ’s new Cyber Security Strategy 2026-2030 proposes making directors personally liable – up to $500,000 – for failing to meet minimum security standards. Right now that’s aimed at critical infrastructure: power, water, health, finance, telecommunications and the like. But the direction of travel is clear, and a new civil penalty regime under the Privacy Act is being considered alongside it – and the Privacy Act reaches a lot more of us than critical infrastructure does.
What a business owner should actually do this quarter
Here’s the good news – you don’t need to panic or spend a fortune. Three simple things will put you ahead of most:
- Turn multi-factor authentication (MFA) on everywhere – email, remote access and admin accounts.
- Write down who does what the day you’re breached – a one-page incident plan beats a blank stare.
- Check your cyber insurance actually pays out – read what it requires of you, before you need to claim.
That’s it. Not a big beast – just the basics, done properly, before the law makes them your problem personally.
Want to know where you stand?
We help Northland business owners get the basics right without the jargon or the scare tactics. See how we keep businesses secure, or get in touch for a straight conversation about where you stand.