Five Mobile Device Attacks That Put Your Practice at Risk
Your team starts the day checking emails on their phones before they even reach the office. By the time they sit down, they've already accessed client records, responded to referrals, and approved a document - all from a device that probably has no more security on it than a personal handset. That gap between how much work happens on mobile devices and how much protection those devices actually have is exactly where attackers are focusing their attention.
Mobile devices now carry the same sensitive information as any office computer. Client files, login credentials, payment details, confidential correspondence - it's all there. But most small practices treat phones and tablets as personal items rather than business tools that need proper security. That means no antivirus, no monitoring, no control over what gets installed, and no visibility when something goes wrong. Under the NZ Privacy Act 2020, a breach is a breach regardless of which device it came from.
There are five ways attackers are getting into mobile devices right now. The first is apps that look legitimate but carry malware hidden in the background - sometimes the app even works as advertised, so there's no obvious sign anything is wrong. The second is unencrypted messaging, where passwords or sensitive details sent over standard text or chat apps can be intercepted if the connection isn't protected. Third is public Wi-Fi, where a hacker on the same network can quietly capture data being transmitted - this is called a man-in-the-middle attack, and it's more common than most people realise. Fourth is public USB charging stations, which can be modified to copy data from any device plugged into them - if your team charges their phones at airport or café charging points, this is a real exposure. Fifth, and most overlooked, is simply running an outdated operating system. When a phone stops receiving security updates, known vulnerabilities stay open indefinitely.
When mobile devices are properly managed, the risks above are largely addressed before they become incidents. Software updates happen automatically, risky apps can be blocked or removed remotely, and if a device is lost or stolen the data on it can be wiped before it reaches the wrong hands. Your team can still use their phones normally - they just do it on a device that's actually secure. That's what mobile device management looks like in practice, and it sits naturally alongside managed IT support for the rest of your infrastructure.
The practical step is to get an accurate picture of what devices are accessing your systems and what state they're in. Many practices are surprised to find old phones still connected to business email, or personal devices with no pin lock holding access to confidential client data. That audit is the starting point - everything else follows from knowing what you're actually dealing with. For more on keeping your business protected across all devices, the ITstuffed cybersecurity page covers the broader picture.
If you'd like a quick read on where your current setup stands, ITstuffed offers a 15-minute IT Fit Check. Book one at itstuffed.co.nz/booking.