A crude DDoS flood halted New Zealand's stock exchange four days running

On the afternoon of Tuesday 25 August 2020, NZX — New Zealand's stock exchange — was hit by what it described as a volumetric distributed denial-of-service attack arriving from offshore via its network service provider. The flood saturated NZX's network connectivity and took down its websites and its Markets Announcement Platform, the channel market participants rely on for price-sensitive disclosures. NZX halted trading in its cash markets at about 3:57pm and could only restore connectivity after mitigating the attack.

The attacks did not stop. On Wednesday 26 August a renewed DDoS forced NZX to halt trading again at 11:14am, with the main board, debt market and Fonterra shareholders' market reopening about four hours later. Thursday brought a third halt. On Friday 28 August NZX crashed a fourth time on what it called connectivity issues similar to those caused by the week's attacks, resuming at 1pm. Spark, the network provider, said the traffic came through the global gateway and so clearly originated offshore, but tracing the origin was near impossible.

By the fourth day the government had activated national-security machinery: Finance Minister Grant Robertson said the Government Communications Security Bureau and the national cyber-crime agency had been called in. Security experts publicly asked how a national exchange could be disrupted four days running by a blunt flooding attack. Nobody was ever identified or charged, and NZX's answer to the week was an expensive hardening programme — new DDoS protection, architecture changes and continued resilience investment.

Four straight days of halted trading across NZX's cash, debt, Fonterra and derivatives markets, with the GCSB called in — the attackers were never identified

NZX's public-facing connectivity — websites and the disclosure platform — sat in the blast radius of a network-level flood, and trading legally cannot proceed without the announcement platform.

Mitigation depended on the network service provider, and no independently controlled overflow capacity stopped four consecutive days of outages.

A volumetric DDoS is the crudest and cheapest attack in the book; defences sized for ordinary traffic peaks were nowhere near enough for a sustained flood.

The exchange kept resuming and getting knocked down rather than moving to a protected architecture after day one — the government had to intervene by day four.

An exchange's real attack surface is its network pipe. If mitigation depends on one provider's goodwill and there is no overflow plan, a blunt flooding attack can shut a national market down for days.

The week ended with NZX trading again — Friday's session resumed at 1pm — but the exchange spent the following years rebuilding its network resilience under regulatory scrutiny. The Financial Markets Authority kept NZX's capability and resilience investment under review; by its annual obligations review for the year ended June 2025, published in June 2026, the FMA found NZX effectively met its market-operator obligations, citing continued investment in market capability and resilience, and made no formal recommendations. The identity of the attackers has never been established.