What Happens If Your Website Gets Hacked NZ Guide
Table of Contents
- Immediate Steps to Take When You Discover a Website Hack
- Privacy Act 2020 Data Breach Notification: Your Legal Obligations
- Reporting a Cyber Security Issue: NCSC and CERT NZ
- How to Clean a Hacked WordPress Site: A Forensic Recovery Workflow
- Contacting Your Website Developer and Managing Customer Communication
- Cyber Insurance, Financial Recovery, and Reputation Management
- Frequently Asked Questions
Last Updated: September 14, 2026
Immediate Steps to Take When You Discover a Website Hack
According to the National Cyber Security Centre’s 2026 threat assessment, over 4.3 million account details belonging to individuals in this country are exposed to scammers, and roughly 26,000 devices are estimated to be infected by malware. If your site is showing strange redirects, unexpected admin users, or a sudden drop in traffic, you may be dealing with a website hacked nz situation. The first hour matters more than any other.
What happens if my website gets hacked NZ is a question with a clear answer: you contain the damage, preserve evidence, and work through a defined sequence rather than panicking.
Here is the sequence that limits damage:
- Take the site offline or enable maintenance mode to stop further data compromise
- Change all administrator passwords and rotate hosting, database, and FTP credentials
- Enable two-factor authentication on every admin account
- Preserve server logs before they roll over
- Notify your hosting provider and website developer
A common mistake is deleting suspicious files immediately. That destroys the digital forensics trail you will need to prove what happened.
Do not restore from backup before you have identified the entry point. If the security vulnerability remains, the same malware infection returns within days.
Privacy Act 2020 Data Breach Notification: Your Legal Obligations
Under the Privacy Act 2020, you must notify the Office of the Privacy Commissioner and affected individuals if a data breach is likely to cause serious harm. This is a legal obligation, not a courtesy. The Office of the Privacy Commissioner’s breach guidance sets out the assessment you need to make.
The Manage My Health breach in 2026 shows how this works in practice. An investigation determined that 5-6% of the user base was affected, covering 120,000 individuals, which allowed targeted customer notification (Manage My Health breach FAQs).
When assessing harm, consider the type of data compromised, whether it was encrypted, and who could access it. Document every decision. If you are unsure whether notification is required, notify anyway; the cost of over-reporting is far lower than the cost of a complaint upheld against you.
Reporting a Cyber Security Issue: NCSC and CERT NZ
Reporting a cyber security issue to the National Cyber Security Centre is encouraged but not mandatory for most businesses. There is no legal obligation to report every hack, yet reporting limits damage and protects customer confidence (business.govt.nz guidance on hacks).
| Action | Who to contact | Timeframe |
|---|---|---|
| Serious privacy breach | Office of the Privacy Commissioner | As soon as practicable |
| Active attack in progress | Your hosting provider | Immediately |
| Cyber threat intelligence | National Cyber Security Centre | Within days |
| Financial fraud | Your bank and Police | Immediately |
A single email address tied to your organisation can appear across numerous publicly disclosed breaches, creating a long-term risk that outlasts the original incident (NCSC Quarter Four Cyber Security Insights).
How to Clean a Hacked WordPress Site: A Forensic Recovery Workflow
Most guides stop at “scan and delete”. A forensic recovery workflow is different: it treats the compromised site as a crime scene first and a rebuild second. The Protective Security Requirements case study notes that compromised public websites face reputational damage and unauthorised access to information systems, and the evidence you preserve in the first hour is what lets you prove scope, notify accurately, and support an insurance claim later.
Work through these stages in order. Skipping ahead is the single most common reason a cleaned site is reinfected.
1. Isolate without destroying evidence
Put the site into maintenance mode or take it offline, but do not wipe the server. Before you change a single file, capture:
- A full snapshot of the web root and the database (most hosts offer one-click snapshots; if not, export via your control panel)
- A copy of the raw access logs, error logs, and any PHP-FPM or application logs your host retains
- The current file listing with timestamps and checksums, so you can spot files modified outside a known deployment window
A common pattern is that logs roll over within 24 to 72 hours depending on host retention. If you wait until Monday to look at a Friday incident, the evidence may already be gone.
2. Identify the entry point
This is the stage competitors skip. You are looking for the how, not just the what.
Start with the access log and look for:
- POST requests to
wp-login.php,xmlrpc.php, oradmin-ajax.phpfrom a single IP at high volume (credential stuffing) - Requests to plugin or theme files that should not accept direct input, such as a
file.phpin a plugin folder receiving query parameters - New or modified files in
wp-content/uploads, which should never contain executable PHP - Unexpected admin users, scheduled tasks (cron entries), or mu-plugin files
Cross-check against your last known-good backup. A diff between the live file tree and a clean backup will usually surface the dropped web shell within minutes. Look for obfuscated PHP, base64-encoded strings, and files with recent modification dates that do not match any plugin or theme update.
Common entry points, in rough order of frequency:
- An outdated plugin or theme with a known vulnerability
- A reused or weak administrator password with no two-factor authentication
- A compromised hosting account or FTP credential
- A nulled or pirated plugin bundling a backdoor
3. Eradicate and patch
Remove the malicious code, but only after you have identified how it got in. Then patch the vulnerability itself: update the plugin, theme, or core version that allowed entry, remove any plugin you no longer use, and delete any administrator account you cannot account for.
If you cannot confidently identify the entry point, the safest option is a full rebuild from a known-clean source rather than a surgical clean.
4. Restore from a verified clean backup
Restore the database and files from a backup taken before the compromise. Run a malware scan on the backup itself before restoring. Restoring an infected backup is the most common reason a site is re-hacked within 72 hours.
After restore, rotate every credential: database passwords, WordPress salts, API keys, and any third-party integration tokens.
5. Monitor for reinfection
Watch access logs and file integrity for at least 30 days. Set up file-change alerts if your host offers them. A quiet site is not proof of a clean site; reinfection often happens silently through a dormant backdoor.
Before restoring, run a malware scan on the backup itself. Restoring an infected backup is the most common reason a site gets re-hacked within 72 hours.
Recent backups allow businesses to restore corrupted or hacked sites in minutes rather than days (Bright Box recovery guidance). The thing nobody tells you about website hacked nz recovery is that plugin and theme files are the usual entry point, not core WordPress itself.
Contacting Your Website Developer and Managing Customer Communication
Your website developer should be your first technical call, not your last. A developer can trace the entry point, patch the security vulnerability, and handle system restoration while you focus on customers. Proactive maintenance extends beyond basic web infrastructure to include securing digital accounts against unauthorized access through automated trading interfaces.
For customer notification, keep the message direct and free of jargon:
“We recently identified unauthorised access to our website. We have contained the incident, engaged specialists, and reset affected credentials. If your password was compromised, you will be asked to reset it. We take this seriously and will share updates as our review progresses.”
Adopt a post-incident review procedure, sometimes called CRIED, to record what happened for future reference (Steadfast NZ incident management). This documentation also supports any cyber insurance claim you may file.
Customers forgive breaches faster when communication is prompt and honest. Silence damages trust more than the hack itself.
Cyber Insurance, Financial Recovery, and Reputation Management
Cyber insurance is the recovery lever most small businesses overlook until after an incident, and it is where the financial outcome of a hack is often decided. Policies typically cover forensic investigation, legal costs, customer notification, public relations support, and business interruption, but only if you report promptly and follow your insurer’s incident response panel.
Making a claim that actually pays out
The mechanism matters more than the policy wording. Most insurers require you to:
- Notify them as soon as you suspect a breach, not once you have finished cleaning up
- Use their approved forensic or incident response provider rather than engaging your own without approval
- Preserve evidence, including logs and affected systems, until the insurer confirms you can wipe them
- Document every cost, including staff hours, so business interruption can be quantified
A common pattern is that claims are reduced or declined because the business notified late, engaged an unapproved provider, or destroyed the evidence trail. Check your policy’s notification window before you need it, and keep the incident response contact somewhere your team can find it at 2am.
Quantifying the financial impact
Downtime is the cost most owners underestimate. For an ecommerce site, every hour offline is lost revenue plus the cost of recovery staff, forensic work, and any customer remediation. Build a simple estimate:
- Average hourly revenue during the affected period
- Hours of downtime
- Cost of specialist recovery or rebuild
- Cost of customer notification and any credit monitoring offered
- Staff hours diverted from normal work
This figure is what you present to your insurer and what you use to justify investment in prevention afterwards.
Reputation management: the first 90 days
Competitors rarely address this well, and it is where trust is won or lost. Practical steps:
- Publish a clear incident statement on your homepage, dated, and update it as the review progresses
- Monitor review platforms and search results for the following 90 days
- Request removal of any malicious content indexed by search engines, and submit a reconsideration request if your site was flagged
- Brief your team so front-line staff answer questions consistently
- Consider a short holding statement for social media, so replies are not improvised
A customer notification template you can adapt
“We recently identified unauthorised access to our website. We have contained the incident, engaged specialists, and reset affected credentials. If your password was compromised, you will be asked to reset it. We take this seriously and will share updates as our review progresses.”
Keep it direct, free of jargon, and specific about what the customer should do next. Silence damages trust more than the hack itself.
Customers forgive breaches faster when communication is prompt and honest. The businesses that recover best treat insurance, financial tracking, and reputation as one workflow, not three separate problems.
Financial recovery also depends on business continuity planning. A documented plan shortens downtime and gives your insurer a clear timeline. For businesses running WooCommerce or custom applications, building recovery workflows into the development process ensures restoration is a defined procedure rather than an improvisation.
Frequently Asked Questions
What are my legal obligations if customer data is stolen from my website?
Under the Privacy Act 2020, you must notify the Office of the Privacy Commissioner and affected individuals if a data breach is likely to cause serious harm. This notification should happen as soon as reasonably practicable after discovering the breach. Failure to comply can result in fines up to $10,000. You should also document what happened, what data was compromised, and what steps you took to mitigate the damage. Even if you are unsure whether serious harm is likely, it is wise to seek legal advice or contact the Privacy Commissioner for guidance.
Do I need to report a website hack to the NCSC or CERT NZ?
Reporting a cyber security issue to the NCSC or CERT NZ is not mandatory under current law, but it is strongly encouraged. These agencies can provide advice, track threats, and help prevent similar attacks on other businesses. The NCSC handles incidents involving national significance, while CERT NZ supports small businesses and individuals. Reporting also helps build a clearer picture of the threat landscape. You can report online through their websites, and they will guide you on next steps without taking over your recovery.
Can a hacked website be recovered, and how long does it take?
Yes, most hacked websites can be fully recovered. The timeline depends on the severity of the compromise and whether you have recent backups. If you have a clean backup, restoration can take a few hours. Without backups, recovery may involve forensic analysis, malware removal, and rebuilding compromised files, which can take days or weeks. Working with a professional developer speeds up the process and helps ensure no backdoors remain.
How do I tell if my website has been hacked?
Common signs include unexpected redirects to unfamiliar sites, a sudden drop in traffic, warnings from Google about malware, new admin users you did not create, and visible defacement. You might also notice your site running slowly or your hosting provider suspending your account. Checking server logs for unauthorized access and running a security scan can confirm a breach. If you suspect a hack, take your site offline immediately to prevent further damage and begin your incident response plan.
A website hack tests your systems, your documentation, and your customer relationships at once. Most businesses discover their incident response plan is incomplete only when they need it. Web Maniacs provides personalised web and app development, custom software suited to your business, and results-driven digital marketing, so your site is built for resilience and recovery from day one. Get started with Web Maniacs and protect the online presence your customers rely on.
