When Cyber Criminals Aim Small: What NZ Businesses Need to Know About the Mid-Market Bullseye

There is no disputing that digital transformation is opening new opportunities for businesses. AI, cloud platforms, automation and data are all reshaping how organisations operate, reach customers and grow.

But these same trends are also reshaping the economics of cybercrime.

New incident data presented at New Zealand’s National Cyber Security Summit this year suggests ransomware actors are not primarily chasing the very largest enterprises. Instead, they are deliberately focusing on the mid-market, and many of those organisations are still carrying the risk largely uninsured¹.

For commercial and mid-sized businesses, this shift has real implications for how cyber risk is understood, managed and transferred.

Why the mid-market is in focus 

Analysis of more than 3,000 incident response cases across Australia and New Zealand over 12 years shows around 42% of ransomware attacks are directed at businesses with annual turnover between approximately NZ$10 million and NZ$100 million². In other words, many attackers are actively choosing mid-sized organisations.

There are some straightforward reasons for this:

• Big enough to pay – These businesses often have the financial capacity to meet six or low seven-figure ransom demands, or at least to fund significant recovery costs.

• Small enough to fly under the radar – They are less likely to trigger scrutiny from intelligence agencies or coordinated law-enforcement efforts than major multinationals.

• Digitally dependent, but unevenly protected – Operations are increasingly digital, yet security maturity, incident response planning and insurance uptake can lag behind larger corporates.

For many New Zealand business owners and boards, this challenges a long-held assumption: “We’re too small to be a serious target.” Size, in this context, is being measured by something different – the ability to pay, and the likelihood of being noticed.

The cost of an incident even before any ransom 

The same dataset highlights the scale of costs that can follow a serious ransomware event:

• Recovery costs including legal, PR and technical containment, but excluding any ransom average in the low hundreds of thousands and reach into the millions in larger cases³

• Median opening ransom demands around the low seven-figure mark, with some much higher

• Median final settlements (where paid) in the hundreds of thousands

For New Zealand context, Kordia’s 2025 New Zealand Business Cyber Security Report found that 59% of surveyed organisations had experienced a cyberattack or incident in the previous 12 months. Reported impacts included operational disruption, data compromise, cyber extortion and ransom payments⁴.

Separate industry commentary has suggested that around 70% of uninsured small and medium businesses across New Zealand and Australia that receive a ransom demand do not survive into the following year – largely because they cannot absorb the cost of prolonged business interruption⁵.

For mid-market firms with tight margins or heavy fixed costs, the combination of operational downtime, specialist recovery expenses and reputational damage can be difficult to weather – even when a ransom is never paid.

The protection gap: Who is and isn’t insured? 

Cyber insurance has grown rapidly at the large-corporate end of the market. Some global estimates indicate cyber cover penetration among very large companies is already in the region of 80%⁶.

By contrast, cyber insurance take-up among New Zealand SMEs is often reported at around 10%, with mid-market firms somewhere in between⁷.

This creates a protection gap precisely where attackers are most active.

Aon New Zealand’s cyber practice leader, Duncan Morrison, notes that part of the issue is regulatory pressure, or the lack of it. New Zealand’s enforcement environment has historically been less punitive than in some other jurisdictions, which can reduce the perceived urgency for organisations to fully interrogate their cyber exposure and coverage position.

The result is that many businesses:

• Assume existing policies (such as management liability or property) will respond to cyber events, only to discover exclusions or sub-limits when they need cover most

• Many organisations assume their vendors or managed service providers will lead the response or cover the costs of a cyber incident, however this expectation is often not reflected in contractual obligations and may be impractical during a widespread event where the provider is responding to multiple affected clients simultaneously.

• Underestimate the value of the non-indemnity services that dedicated cyber policies often provide, such as incident response, forensics, legal guidance and crisis communications support

• Delay conversations about cyber insurance until after a close call or an actual incident

Regulatory expectations are rising 

While enforcement has been relatively measured, the regulatory landscape in New Zealand is shifting. Key developments include:

• Privacy Act 2020 – Introduced mandatory notification of privacy breaches likely to cause serious harm, obliging organisations to notify both the Office of the Privacy Commissioner and affected individuals.

• New Zealand Cyber Security Strategy 2026–2030 – Sets out the government’s long-term approach to cyber resilience and includes an action plan to raise cyber security standards across the economy⁸.

• Critical infrastructure discussions – Recent consultation papers have proposed mandatory cyber security requirements for certain critical infrastructure entities across sectors such as energy, finance, health, transport and communications.

While not every commercial business will fall directly under critical infrastructure rules, these changes indicate a clear direction of travel and expectations around cyber preparedness, governance and transparency are increasing.

For boards and owners, this combination of targeted attacks and evolving regulation makes cyber risk a core governance issue – not just an IT concern.

What this means for New Zealand commercial businesses 

For mid-market and larger SME organisations, three practical themes emerge:

• 1. Re-frame the risk profile
  Rather than assuming “we’re too small,” it may be more accurate to ask:

  • How dependent are we on digital systems for revenue and delivery?

  • How attractive would we be to an attacker seeking a realistic, payable ransom?

• 2. Focus on controls that matter most
  Attackers continue to exploit familiar weaknesses: unpatched systems, weak or reused passwords, lack of multi-factor authentication, and staff being tricked by convincing emails. Sharpening a small number of foundational controls can significantly reduce both the likelihood and impact of incidents.

• 3. Treat cyber insurance as part of resilience – not a substitute for it
  When aligned with a sound control environment, cyber insurance can:

  • Help fund specialist forensic, legal and communications support

  • Cover elements of business interruption and recovery costs

  • Provide access to structured incident response processes at a time when clarity is most needed

The conversation is increasingly moving beyond “Should we buy a policy?” to “How does our cover fit with our actual risk profile, and would it perform under the kinds of incidents we now know are most likely for our size and sector?”

A more informed conversation 

The emerging data is sobering, but it is also empowering. New Zealand businesses are not facing an unknowable risk, instead we now have clearer insight into who is being targeted, how attacks unfold and where the biggest gaps sit.

This creates an opportunity to have more focused, practical conversations with boards, brokers and advisers about:

• True exposure in today’s threat landscape

• The adequacy of existing controls and governance

• The role that dedicated cyber insurance can play in closing the protection gap

With the right information and support, businesses can move from hoping they are “too small to be noticed” to building a level of preparedness that matches the reality of today’s cyber economy.

As cyber exposure becomes more complex, our team can help you understand, quantify and manage your cyber risk.  

Contact Aon

¹Insurance Business New Zealand
²Insurance Business New Zealand
³National Cyber Security Consulting
⁴nationalcybersecurity.com
⁵Insurance Business New Zealand
⁶thehambergerreport.com
⁷Insurance Business New Zealand
⁸New Zealand Cyber Security Strategy 2026–2030 and Cyber Security Action Plan 2026–2027

Related articles

• Bridging the Gap Between Innovation and Cyber Risk in New Zealand’s Food Agribusiness and Beverage Industry

• Laying In Wait: What On-farm Cyber Crime Looks Like

• How Cyber Insurance Saved This Small Business

 

© 2026 Aon New Zealand    
This content is not intended to address your specific situation nor is it intended to provide advice. You should review the information in the context of your own circumstances. While care has been taken in the production of this content, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the content and can accept no liability for any loss incurred by any person who may rely on it. This content has been compiled using information available to us up to its date of publication.