On 10 September a New Zealand payroll company told its customers that their names, IRD numbers, addresses, bank account details and payment histories had been accessed by someone who should not have had them. The detail worth pausing on is what the company said next. None of its own systems had been breached. The information went out through a reporting tool it had installed to look at its own numbers.
The tool was Metabase, a widely used business intelligence product that sits on top of a company’s databases and turns them into charts. On 6 August its developers published a security advisory describing “a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance”. It scored 10 out of 10 on the standard severity scale, the maximum, and the advisory confirmed the flaw was already being used in real attacks. Someone who got in could, in the advisory’s words, “change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data”.
That last clause is the whole problem. Metabase is a window onto other systems. Take over the window and you inherit the view.
Thankyou Payroll, which serves a number of charities, took the tool offline, made customers reset their passwords and notified the Office of the Privacy Commissioner. “We know our customers trust us with important information and we apologise for the concern and disruption this incident may cause,” the company told RNZ, adding that it understood it was “one of a number of businesses impacted as this is a global incident involving many companies worldwide”. That is a fair description. The same flaw has been publicly linked to data theft at the laptop maker Framework, the form builder Tally and the developer tool Kilo Code, and the threat intelligence firm Dataminr counted thousands of exposed installations worldwide across government, health, energy, finance and aviation.
It landed in a bad fortnight. RNZ reported on 11 September that police were investigating a separate breach at Dunedin health research company Zenith Technology, and that the maths platform Mathspace had confirmed student and staff data was downloaded.
None of this is really a story about payroll, health research or schools. It is a story about how software gets built now, and it applies to almost every business website in the country.
Twenty years ago a company’s website was mostly code written for that company. Today it is an assembly. A content management system, a theme, a payment gateway, an analytics script, a chat widget, a booking engine, a dozen plugins, and underneath it a few hundred open source libraries nobody involved has ever looked at. The HTTP Archive’s 2025 Web Almanac found 90 percent or more of web pages load code from at least one third party. The figure for what runs on the server, out of sight, is higher still.
The security research firm Patchstack counted 11,334 new vulnerabilities across the WordPress ecosystem during 2025, a 42 percent increase on the year before, in its State of WordPress Security in 2026 report. Ninety-one percent were in plugins and 9 percent in themes. Only six were in WordPress itself, and all six were low risk. The platform is not usually the weak point. The things bolted onto it are.
Two findings should change how business owners think about updates. The first is speed. Patchstack measured how long attackers took to start exploiting newly published flaws and found the weighted median was five hours. About half of high impact vulnerabilities were attacked within a day of becoming public. A patch released on a Friday afternoon and applied on Monday morning is not a fast response. It is a long weekend with the door open.
The second is that 46 percent of the vulnerabilities disclosed had no fix from the developer at the time they became public. Patchstack’s blunt conclusion is that “website owners can’t rely on plugin updates as a security measure”. Sometimes there is nothing to install, and sometimes the plugin has been abandoned. Attackers know it, which is why only four of the ten most heavily attacked vulnerabilities last year were new. The other six were old holes on sites nobody was maintaining.
Here is the part that catches New Zealand businesses out. Handing the work to a supplier does not hand over the responsibility. Under section 11 of the Privacy Act 2020, when one organisation holds personal information on behalf of another, the law treats that information as held by the organisation it belongs to, not the one storing it. Your host, your payroll provider, your booking platform and your marketing agency all hold customer information for you. Legally it is still yours, and if it leaks and serious harm is likely, you are the one who has to notify the Privacy Commissioner and the people affected.
The Commissioner made the point with some force this year. On 27 May he released the findings of his inquiry into the December 2025 Manage My Health breach, which put the health records of close to 100,000 New Zealanders up for sale, most of them Northland patients. He found that both the portal operator and Health New Zealand had failed to ensure reasonable security safeguards were in place. Among the lessons he set out for everyone else was this one. “Over-reliance on a vendor’s information about its security and privacy risk profile can be problematic – a degree of independent assessment is essential.”
His strongest available response was a compliance notice. The maximum fine under the Privacy Act is $10,000, and he has asked for the power to impose penalties running into the millions. Whether or not Parliament agrees, the reputational arithmetic has changed already.
The National Cyber Security Centre reported on 20 August that it handled 1,129 incident reports between April and June, with 92 serious enough to need specialist technical support, up from 77 the quarter before. Deputy Director-General Catriona Robinson said that “while the total number of reports has remained relatively stable, we are seeing an increase in incidents that require specialist technical support because of their potential national impact”. Unauthorised access accounted for about $1.3 million of the $2.7 million in direct losses reported, about half the total from a small share of the incidents.
So what should a business do, short of rebuilding everything. Start with a list. Most owners cannot say what software their website runs, who installed it, or which of it still gets updates. That list is the cheapest security work available and it takes an afternoon. Then name the person responsible for applying updates, with a timeframe measured in hours for critical flaws, not weeks. Anything administrative that does not need to face the public internet should not face it, the control that would have blunted the Metabase attacks. Ask your suppliers, in writing, what they run, how quickly they patch, and how they would tell you if something went wrong. And hold only the personal information you use, because data you never collected cannot be stolen.
None of that is glamorous and none of it shows up on the website. But the businesses that came through this month without a bad week were not the ones with the cleverest technology. They were the ones where somebody was still paying attention to the ordinary parts.
Roger McSaveney is General Manager of Forge Creative, an Auckland web design and development agency.
Do you know what software your website is actually running, and who keeps it updated? Tell us in the comments below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job 🙂
Leave a Reply