Over the past six months, NZ software customers have watched vendor after vendor make the news. The Canvas breach reached more than 30 NZ tertiary institutions and schools. Mathspace exposed more than a million users across New Zealand and Australia. ZenTech, a Dunedin lab services company, was hit by ransomware, and Coroners Court information was caught up in it. The pattern repeats: a customer trusted a supplier, and the supplier's weakness became theirs. This guide sets out the questions NZ customers now ask, and the evidence you should have ready.
What did each incident show?
Canvas (Instructure)
Canvas, the learning platform, was breached between late April and mid May. The Ministry of Education estimates that 110,000 to 120,000 NZ students and staff were affected. One compromised vendor reached many institutions at once.
Mathspace
Mathspace says unauthorised access dated back to 10 August and data was downloaded on 27 August. Reporting on its disclosure says attackers used a critical vulnerability that had sat unpatched for more than three weeks. Over a million students, parents and staff in Australia and New Zealand were exposed.
ZenTech (Dunedin)
ZenTech's ransomware attack came around August. The Ministry of Justice says Coroners Court information from Otago and Southland, mostly 2016 to 2022, was affected, and it is unclear how ZenTech came to hold it. The High Court granted an interim injunction over Health NZ and ZenTech data.
Thankyou Payroll (Sub-processor Exposure)
Thankyou Payroll shows a fourth variant. Its own systems were not breached. A third-party analytics tool it used, Metabase, was compromised in a global incident, and customer data was inside that tool. That is why the sub-supplier question matters: your assurance is only as strong as your suppliers' suppliers.
Why does this keep happening? The NCSC says digital supply chain compromises have been responsible for major incidents in New Zealand, and that the health sector has been hit more than once through third-party applications holding sensitive personal information. A supplier holds many customers' data in one place, so it is a better target than any single customer.
What does the NCSC tell customers to check?
The NCSC's Cyber Threat Report 2026 says the common factors across many incidents are lack of authentication such as MFA, over-permissioned access, and poor separation of data. It suggests customers ask three things:
- Do you assess a supplier's cyber security when you buy?
- Do you get ongoing assurance?
- Do contracts set clear data protection and security expectations?
In the Manage My Health inquiry, the Privacy Commissioner added a warning for vendors. If a processor makes a design decision that goes beyond its customer's instructions, it is treated as acting on its own account and is independently liable. The Commissioner has also said that relying on vendor assurances alone is problematic. Expect customers to ask for proof.
What will customers ask, and what can you show?
Here are the questions we expect in your next security review, with the evidence that answers each.
1. MFA Enforcement
"Is it enforced for every user and admin?"
What to show: A configuration export and a penetration test that actively tried to bypass or circumvent it.
2. Access & Authorization
"Can one user or customer reach another's data?"
What to show: An authenticated test with two accounts and two tenants. Our guide to API penetration testing explains what that test examines across modern endpoints.
3. Data Separation
"How is our data kept apart from other customers' data?"
What to show: Tenant isolation testing results and a concise architecture summary demonstrating separation.
4. Patching Cadence
"How fast do you fix critical vulnerabilities?"
What to show: Your defined remediation SLAs and dated fix records. The Mathspace patch delay is the exact example customers will cite.
5. Independent Testing & Retesting
"When was your last independent test, and were the fixes retested?"
What to show: A dated CREST-certified penetration test report and the retest verification record. Our guide to retesting and confirmed closure explains what a good closure record looks like.
6. Sub-processors
"Who else holds our data?"
What to show: An up-to-date register of subprocessors and the security assurance certificates held on each.
7. Breach Notification
"How fast will you tell us?"
What to show: Your contractual breach notice commitment clause and 24/7 security contact channel.
What Should You Do This Month?
Name one person to own the evidence pack. Gather the seven pieces in one folder, date each one and note which are missing. A test from two years ago says little about today's code. Close any MFA gap first, because it is quick and the NCSC names it. Then commission an authenticated test with two accounts and two tenants, fix what it finds and retest. If you are the customer, use the same list in reverse and ask your vendors for the evidence before the next renewal.
What about schools?
Schools can also check Safer Technologies for Schools (ST4S), the trans-Tasman assessment overseen by the Ministry of Education. Products receive a risk rating of low, medium, high or non-compliant, and a badge shows a product met the minimum standard. The assessment starts with supplier answers, so independent test evidence still adds weight. Our guide to why penetration testing matters for ST4S covers the schools angle in detail.
Book your free PTaaS demo and ask our CREST-certified testers to scope an authenticated test that answers your customers' questions.
Frequently Asked Questions
What does the NCSC say about supply chain risk in NZ?
The NCSC's Cyber Threat Report 2026 says digital supply chain compromises have caused major NZ incidents. Common factors are lack of authentication such as MFA, over-permissioned access and poor separation of data. It asks customers whether they assess suppliers when buying, get ongoing assurance and set contract clauses.
What security questions do NZ customers ask software vendors?
Expect questions on MFA enforcement, whether one customer can reach another's data, how data is separated, how fast critical vulnerabilities are fixed, when the last independent test was and whether fixes were retested, who else holds the data, and how fast you will report a breach.
What evidence should a software vendor hold ready?
Hold an MFA configuration export and bypass test, an authenticated two-account, two-tenant test, tenant isolation results, dated patch records, a dated CREST-certified report with retest record, a subprocessor list and your breach notification clause. Date everything and name an owner.
Who is responsible when a supplier handles personal data?
In the Manage My Health inquiry, the Privacy Commissioner said a processor that makes a design decision beyond its customer's instructions is treated as acting on its own account and is independently liable. The customer has duties too, so both sides need evidence.
What is ST4S?
Safer Technologies for Schools is a trans-Tasman assessment of digital products used in schools, overseen in New Zealand by the Ministry of Education. Products receive a risk rating of low, medium, high or non-compliant, and a badge shows they met the minimum standard.
