| Topic | Current draft response |
| What happened | The Dryden website was compromised. The site has since been remediated and verified clean. |
| Who may be affected | Approximately 4,100 individuals may have been affected. |
| Information that may be involved | Names, e-mail addresses, telephone numbers, residential, delivery and project addresses, company or business names, and customer account numbers may have been subject to unauthorised access or disclosure. |
| Customers impacted | It appears that consumers, homeowners, retailers, architects & specifiers, group home builder and construction companies are on the contact list. |
| Consumer action | Consumers should remain alert for unusual communications and avoid sharing personal information unless they are confident the request is legitimate. |
We recently became aware of a cyber incident involving the Dryden website. Our investigation has identified
that some information submitted through the website may have been accessed or disclosed without
authorisation.
The issue was identified and investigated on 4 August 2026. We are continuing to assess the incident and will
provide further information if relevant facts change.
The website was compromised through a known WordPress vulnerability. The site has since been remediated
and verified clean.
Our investigation has identified that approximately 4,100 individuals may have been affected. If you receive a
notification from us, it means your information may have been involved.
The information that may have been subject to unauthorised access or disclosure includes Names, e-mail
addresses, telephone numbers, residential, delivery and project addresses, company or business names, and
customer account numbers.
No, the incident appears to relate to information submitted through the website such as contact details and
business names.
At this stage, the investigation is ongoing. We are treating the information as exposed because unauthorised
access or disclosure may have occurred.
The website has been remediated. Credentials have been rotated, backdoors removed, and the live site has
been independently verified as clean according. We have communicated with those impacted parties and
made them aware of the issue.
The site has been rebuilt on a patched platform and verified clean. We will continue to monitor and respond to
any developments.
We are contacting people whose information may have been involved so they can understand what happened,
what information may have been affected, and what practical steps they can take.
We recommend being alert to unexpected emails, phone calls or text messages that ask for personal
information or encourage you to select links. If you are unsure whether a communication is genuine, contact us
using the official contact details provided in this notification.
The current information does not identify passwords as part of the information involved. However, as a general
precaution, you may wish to update passwords (or implement 2 Factor authentication) if you have reused
passwords across websites or if you notice any suspicious account activity.
Because contact details may have been involved, you should be alert to suspicious emails, phone calls or text
messages. Be cautious of messages that create urgency, ask for payment, request personal information or ask
you to select unfamiliar links.
No. Be cautious of anyone claiming you need to pay a fee to protect your information or resolve this incident.
Please contact Shontelle Crosswell, 021 193 5990 shontelle.crosswell@dulux.co.nz.
Yes, if our investigation identifies further information that is relevant to affected individuals, we will provide an
update.
Yes we have notified the regulator under the Privacy Act 2020 (NZ).
Do not respond, do not click links or download attachments and do not provide personal information unless
you are confident the communication is genuine. If the contact appears to relate to Dryden, please report it to
us using the official contact details provided in this notification.
