'Running as usual': The NZ response to the cyber emergency forcing shutdowns overseas

Emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki over cyber threats are not finding an echo in New Zealand, a quick survey shows.

The rapid and severe response followed warnings that a vulnerability exposed by AI in an extremely common coding language could open the way for hackers to take control of web servers to steal data, disrupt services or move through networks on services the average person relies on every day.

Reports followed of millions of hacking attempts.

RNZ did a whip-around of a dozen or so big private and public organisations, asking if they were exposed and what they had done.

Spy agencies GCSB and SIS

The two agencies said on Friday, "we are well aware of this website security issue and as you would expect have considered what measures are necessary to ensure our websites are secure.

"While we won't go into details of the security settings of our websites we can assure you that they are up and running as usual."

Banks

BNZ said it maintained a strong 24/7 cybersecurity capability to help keep customer data and systems safe and secure.

It worked closely with the National Cyber Security Centre, cybersecurity providers and the broader financial services industry on cyber protection and intelligence, and continue to closely monitor developments, it said.

"For security reasons, we don't discuss specific threats or security controls."

ANZ said, "we have protective and security measures in place to safeguard our systems and customers and continue to monitor the situation closely."

Health NZ

Health New Zealand said it regularly monitored its systems and worked to identify and manage vulnerabilities as part of its ongoing cyber security programme.

"We are taking appropriate steps in response. There are currently no impacts on patient care."

Auckland Transport

Auckland Transport said: "Our investigations to date have identified no exposure within our externally facing services.

"We continue to monitor the situation and have appropriate measures in place to respond if required."

IRD

Inland Revenue said no services had been impacted by the vulnerability.

It reviewed the potential impact on Wednesday when it learned of it.

It did not host any services that used PHP. "No internet accessible instances of services running PHP have been identified."

It had contacted key external digital service providers, the department said.

"We have received assurance services provided to IR are either not impacted or have applied necessary steps to remediate services."

"We continue to monitor and respond to threats including those related to the published PHP vulnerabilities."

It applied advice including from the National Cyber Security Centre.

Others

The Ministry of Business, Innovation and Employment and Department of Internal Affairs boths directed RNZ to the National Cyber Security Centre.

The police said the query would have to be lodged under the Official Information Act. This typically takes several weeks to get an answer.

Another two banks, two airlines and Auckland Council were also approached for comment.