Company Details
neighbourly-co-nz
823
0
519131
neighbourly.co.nz
0
NEI_1924919
In-progress


Neighbourly.co.nz Company CyberSecurity Posture
neighbourly.co.nzNeighbourly is New Zealand’s most popular online social network, helping locals stay connected with their neighbourhoods and ultimately growing stronger, safer and happier communities. With over 900,000 members from Bluff to Kaitaia, our members go through a strict authentication process because we know it’s important for community trust. From lost pets and garage sales, to council updates and crime and safety, Neighbourly members use the website to interact on a huge variety of topics. Neighbourly is also a place for businesses to interact with real locals and turn them into customers – local is what we do. Neighbourly is a New Zealand owned company founded by a team of experienced internet entrepreneurs passionate about building better places to call home.
Company Details
neighbourly-co-nz
823
0
519131
neighbourly.co.nz
0
NEI_1924919
In-progress
Between 800 and 849

Neighbourly.co.nz Global Score (TPRM)XXXX

Description: **Neighbourly Data Breach Exposes User Information, Including GPS and Private Messages** Neighbourly, a community engagement platform, recently confirmed a data breach involving unauthorized access to sensitive user information. According to a company spokesperson, the exposed data included registered users’ names, email addresses, GPS coordinates, public forum posts, and private member communications. While passwords were not accessed, the breach also compromised publicly advertised events and business addresses. The company stated that the vulnerability leading to the breach has been addressed, and its platform is now secure. Neighbourly has taken legal action by seeking a court injunction to prevent the misuse of the stolen data. In a public statement, the company apologized to its members for the incident and any distress caused during the investigation. As part of its response, Neighbourly advised users to remain vigilant against potential scams, particularly those requesting personal information or creating urgency. The company recommended avoiding suspicious email links, manually entering web addresses, and enabling two-factor authentication where possible. Neighbourly confirmed that its website and services are now fully operational following the incident.


Neighbourly.co.nz has 0.0% fewer incidents than the average of same-industry companies with at least one recorded incident.
Neighbourly.co.nz has 25.93% fewer incidents than the average of all companies with at least one recorded incident.
Neighbourly.co.nz reported 1 incidents this year: 0 cyber attacks, 0 ransomware, 0 vulnerabilities, 1 data breaches, compared to industry peers with at least 1 incident.
Neighbourly.co.nz cyber incidents detection timeline including parent company and subsidiaries

Neighbourly is New Zealand’s most popular online social network, helping locals stay connected with their neighbourhoods and ultimately growing stronger, safer and happier communities. With over 900,000 members from Bluff to Kaitaia, our members go through a strict authentication process because we know it’s important for community trust. From lost pets and garage sales, to council updates and crime and safety, Neighbourly members use the website to interact on a huge variety of topics. Neighbourly is also a place for businesses to interact with real locals and turn them into customers – local is what we do. Neighbourly is a New Zealand owned company founded by a team of experienced internet entrepreneurs passionate about building better places to call home.


Vox Media, the leader in modern media, is home to a portfolio of top talent and engaging editorial brands that ignite conversations and set trends, including Eater, Vox, The Verge, SB Nation, The Dodo, New York Magazine, The Cut, and Vulture. The company’s podcast network is one of the largest in th
.png)
Names, email addresses, GPS coordinates, some phone numbers, public forum posts and direct member communications were accessed without...
Neighbourly says some user data was accessed. Here's what was involved and what to do next. Read more on the Hibiscus Coast App.
Names, emails, GPS data and private messages were accessed in the breach.
The website's operator and an external data security team are investigating the claims.
The website's operator and an external data security team are investigating the claims.
The community website is investigating and it is not known if the claims are real.

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of Neighbourly.co.nz is http://www.neighbourly.co.nz.
According to Rankiteo, Neighbourly.co.nz’s AI-generated cybersecurity score is 808, reflecting their Good security posture.
According to Rankiteo, Neighbourly.co.nz currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, Neighbourly.co.nz has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
According to Rankiteo, Neighbourly.co.nz is not certified under SOC 2 Type 1.
According to Rankiteo, Neighbourly.co.nz does not hold a SOC 2 Type 2 certification.
According to Rankiteo, Neighbourly.co.nz is not listed as GDPR compliant.
According to Rankiteo, Neighbourly.co.nz does not currently maintain PCI DSS compliance.
According to Rankiteo, Neighbourly.co.nz is not compliant with HIPAA regulations.
According to Rankiteo,Neighbourly.co.nz is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Neighbourly.co.nz operates primarily in the Online Audio and Video Media industry.
Neighbourly.co.nz employs approximately 823 people worldwide.
Neighbourly.co.nz presently has no subsidiaries across any sectors.
Neighbourly.co.nz’s official LinkedIn profile has approximately 0 followers.
Neighbourly.co.nz is classified under the NAICS code 519131, which corresponds to Others.
No, Neighbourly.co.nz does not have a profile on Crunchbase.
Yes, Neighbourly.co.nz maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/neighbourly-co-nz.
As of January 06, 2026, Rankiteo reports that Neighbourly.co.nz has experienced 1 cybersecurity incidents.
Neighbourly.co.nz has an estimated 1,832 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with breach quickly contained, and remediation measures with issue addressed; platform restored and secured, and recovery measures with website and services fully operational, and communication strategy with public apology, user advisories, and updates during investigation..
Title: Neighbourly Data Breach
Description: Unauthorised access to certain categories of data held by Neighbourly, including registered users’ names, email addresses, GPS coordinates, public forum posts, private member communications, publicly advertised events, and business addresses. Passwords were not accessed.
Type: Data Breach
Common Attack Types: The most common types of attacks the company has faced is Breach.

Data Compromised: Registered users’ names, email addresses, GPS coordinates, public forum posts, private member communications, publicly advertised events, business addresses
Systems Affected: Neighbourly platform
Operational Impact: Platform outage during investigation and remediation
Brand Reputation Impact: Potential reputational damage due to data breach
Legal Liabilities: Potential legal actions; seeking court injunction to prevent use of accessed material
Identity Theft Risk: High (exposure of PII such as names, email addresses, GPS coordinates)
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Names, Email Addresses, Gps Coordinates, Public Forum Posts, Private Member Communications, Publicly Advertised Events, Business Addresses and .

Entity Name: Neighbourly
Entity Type: Platform
Industry: Social Networking/Community Platform
Customers Affected: Registered users

Containment Measures: Breach quickly contained
Remediation Measures: Issue addressed; platform restored and secured
Recovery Measures: Website and services fully operational
Communication Strategy: Public apology, user advisories, and updates during investigation

Type of Data Compromised: Names, Email addresses, Gps coordinates, Public forum posts, Private member communications, Publicly advertised events, Business addresses
Sensitivity of Data: High (PII and private communications)
Personally Identifiable Information: Names, email addresses, GPS coordinates
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Issue addressed; platform restored and secured.
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by breach quickly contained.
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Website and services fully operational.

Legal Actions: Seeking court injunction to prevent use of accessed material
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Seeking court injunction to prevent use of accessed material.

Lessons Learned: Need for more robust processes to prevent future breaches; importance of user awareness and security measures like two-factor authentication

Recommendations: Enable two-factor authentication where available, Remain alert to phishing attempts (unusual calls, emails, or texts), Avoid clicking links in emails; type web addresses directly, Implement enhanced monitoring and incident response processesEnable two-factor authentication where available, Remain alert to phishing attempts (unusual calls, emails, or texts), Avoid clicking links in emails; type web addresses directly, Implement enhanced monitoring and incident response processesEnable two-factor authentication where available, Remain alert to phishing attempts (unusual calls, emails, or texts), Avoid clicking links in emails; type web addresses directly, Implement enhanced monitoring and incident response processesEnable two-factor authentication where available, Remain alert to phishing attempts (unusual calls, emails, or texts), Avoid clicking links in emails; type web addresses directly, Implement enhanced monitoring and incident response processes
Key Lessons Learned: The key lessons learned from past incidents are Need for more robust processes to prevent future breaches; importance of user awareness and security measures like two-factor authentication.

Source: Neighbourly Public Statement
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Neighbourly Public Statement.

Investigation Status: Completed
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public apology, user advisories and and updates during investigation.

Stakeholder Advisories: Advisories issued to staff and members on security best practices
Customer Advisories: Users advised to remain vigilant against scams, enable two-factor authentication, and avoid phishing links
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Advisories issued to staff and members on security best practices, Users advised to remain vigilant against scams, enable two-factor authentication and and avoid phishing links.

Corrective Actions: Issue addressed; platform secured; processes reviewed to prevent recurrence
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Issue addressed; platform secured; processes reviewed to prevent recurrence.
Most Significant Data Compromised: The most significant data compromised in an incident were Registered users’ names, email addresses, GPS coordinates, public forum posts, private member communications, publicly advertised events and business addresses.
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Breach quickly contained.
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Registered users’ names, email addresses, GPS coordinates, public forum posts, private member communications, publicly advertised events and business addresses.
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Seeking court injunction to prevent use of accessed material.
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Need for more robust processes to prevent future breaches; importance of user awareness and security measures like two-factor authentication.
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement enhanced monitoring and incident response processes, Enable two-factor authentication where available, Remain alert to phishing attempts (unusual calls, emails, or texts) and Avoid clicking links in emails; type web addresses directly.
Most Recent Source: The most recent source of information about an incident is Neighbourly Public Statement.
Current Status of Most Recent Investigation: The current status of the most recent investigation is Completed.
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Advisories issued to staff and members on security best practices, .
Most Recent Customer Advisory: The most recent customer advisory issued were an Users advised to remain vigilant against scams, enable two-factor authentication and and avoid phishing links.
.png)
A vulnerability was detected in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /FrontEnd/Albums.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.
Multiple D-Link DSL gateway devices contain a command injection vulnerability in the dnscfg.cgi endpoint due to improper sanitization of user-supplied DNS configuration parameters. An unauthenticated remote attacker can inject and execute arbitrary shell commands, resulting in remote code execution. The affected endpoint is also associated with unauthenticated DNS modification (“DNSChanger”) behavior documented by D-Link, which reported active exploitation campaigns targeting firmware variants of the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B models from 2016 through 2019. Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-27 (UTC). Affected devices were declared end-of-life/end-of-service in early 2020.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.