A March cyber attack on the Hutt City Council – that originated from a staff member responding to a phishing email – has exposed the identity and financial information of hundreds of people to hackers

By Justin Wong of Local Democracy Reporting

The council has confirmed the phishing attack compromised the identity information of five people and 732 people might have had financial information compromised through email correspondence.

It declined a Local Government Official Information and Meetings Act request by Local Democracy Reporting for the full public-excluded report on the incident submitted to the Audit and Risk Subcommittee meeting on Tuesday.

However, it revealed on Wednesday that the attack originated from a staff member responding to a phishing email, which gave attackers access to “a small number” of email accounts. They sent malicious internal and external emails and triggered the council’s cyber security incident response.

“Once identified, the immediate risk was contained within a short period, although investigation and assessment of the impact has continued over subsequent days.”

It called the March incident "deeply regrettable", adding all those affected had been contacted and notified of the steps to be taken in response.

"We unreservedly apologise to anyone affected by this attack. Any exposure of personal information is not acceptable," the council said.

"As criminals use AI to carry out more frequent and sophisticated attacks, they can automate scams, avoid detection, and adapt to security measures. This makes strong monitoring, quick response, and clear reporting essential to protect our systems."

Chief executive Jo Miller said on Wednesday the council had reported the incident to the Office of the Privacy Commissioner.

"We are sorry this has occurred and acknowledge the concern it may have caused. It’s a reminder to us of the need to handle data with sufficient care. We want to reassure the community that additional safeguards have been put in place and system security strengthened.

"We have brought forward our work programme that includes further mitigations to protect council information and prevent any further attack of this nature."

– Local Democracy Reporting is local body journalism co-funded by RNZ and NZ On Air