If you've kept up with the news the past few weeks, you'll have noticed it's been a bit of a horror show in the tech space. Emergency patches, poisoned software updates, stolen keys, and attacks that were already underway before anyone knew about them. It’s been dubbed Black October. And while most of the headlines are about big banks and global software vendors, the lessons are something we need to o consider for construction businesses, because your systems are connected to each other, and you're connected to them.
We don't want to scare anyone (you've got enough to worry about with consents and weather!). But we do think it's worth being straight with you about what's happening, what it means for a business like yours, and what we're doing about it.
What actually happened in October?
A quick, non-nerdy summary. Over a few days around 21 October, a pile of things landed at once:
Emergency patches for common web software.
Critical flaws were found in PHP and Node.js, two of the most widely used technologies used on websites and web apps. Vendors rushed out fixes, and attackers were already probing for unpatched systems.
Poisoned updates.
A popular software package used in AI and cloud tools was compromised so that installing it quietly stole passwords and access keys. Another incident saw attackers use stolen management keys to install malicious plugins on websites, without ever touching the vendor's actual software.
Trust itself got shaken.
A certificate authority (one of the organisations that vouches for the security of websites) had signing keys compromised, and a widely used VPN product had a flaw that let attackers sidestep multi-factor authentication.
If that sounds like a lot of jargon, here's the one-line version: in almost every one of these incidents, the real damage came from stolen keys and credentials, not clever hacking. Patching the hole didn't help if the attacker already had the keys.
Why this matters if you build things for a living
Modern construction operations run on a chain. Job management in WorkflowMAX, for example, flowing to Xero, flowing to payroll, with automations and reports stitched in between. We are WorkflowMAX platinum partners and stand behind it 100% as one of the best systems out there.
But, because everything is connected, it also means one weak link can cascade downstream. A compromised key on one integration can mean wrong invoices, corrupted job data, or payroll running on bad numbers. And in a lot of these systems there's no undo button. Whatever state the data is in right now is the only state there is.
For a mid-sized business, the realistic threat can be something like Black October, or as daft as a disgruntled employee, or an opportunist with a set of working keys, doing damage because they can. Which is exactly why how your keys are managed matters so much more than how fancy your firewall is. So, when it comes to your set up, we can help you have better control of the bits that are at risk.
What we do about it
We build and connect systems for construction businesses every day, so we take this seriously. Here's how we approach it for custom work and systems we manage.
Least privilege, on purpose. Keys and access are scoped to exactly what a feature needs and nothing more. When the scope grows, the key gets rotated. We build role-based apps where each person sees only their own screen, because users can't break what they can't see.
Routine Key Hygiene. Cyber incidents hit the headlines after they’re widely exploited in the wild, which means after compromise. We rotate any keys we generate on a regular schedule, and immediately if there's suspicious activity is logged, or major personnel changes.
A response playbook. If something goes wrong, containment is the priority. We rotate or re-scope the affected key first, suspend the affected integration second, and only take a service fully offline as a last resort. Small blast radius, fast.
Communication discipline. We'll notify you within 24 hours of becoming aware of an incident, keep you updated until it's contained, and work with you on joint messaging so your own clients and staff hear one clear story instead of a vacuum.
Honesty about our third parties. No agency controls its cloud hosts, APIs or accounting platforms, and anyone who tells you otherwise is selling something. What good partners do is tell you what they depend on, monitor it, tell you early when something breaks, and make a plan with you if a dependency starts to degrade.
Written into the contract. Notification windows, key rotation, data location, and suspension rights are being written into our engagements, so none of this relies on good intentions. It's all in black and white.
A word from Kev, our tech dev lead
“When a flurry of vendor emails arrived announcing major exploits in the wild, I took a fully inventory of all the integrations we’ve built for our clients. We didn’t depend on PHP directly but it’s popularity as a choice meant we almost certainly had someone in our supply chain who did.
A swift rotation of provisioned keys and review of logs starts from a posture of “assume you’re compromised and take action pre-emptively” because it’s within our control and because it’s better to play it safe. Then we looked at every dependency in the supply chain and reevaluated they’re responses and recommendations. Patches of vendor systems were announced promptly which reassured us of our dependencies.
Just a day later, node.js, a technology that we do have integrations we maintain in our direct supply chain was found to be vulnerable. We ran the same diligence again. None of our clients were affected, but a once over all recent logs, and a chat to clients about other software they depend on - even if our integration for them doesn’t touch these - was useful in reassuring all parties of how the headlines relate their day-to-day operations and best practices as they navigated reassuring their customers as well.”
Five questions to ask your current software partner
Whether you work with us or not, these are worth asking anyone who touches your systems:
1. Are API keys scoped per role, and per client? If one key opens every door, that's a problem.
2. What happens in the first hour of an incident, and who tells me? You want a name and a timeframe!
3. Where does my data physically live? Hosting provider, region, and whether you'd get notice before that changes.
4. What do you depend on, and what happens when it goes down? Cloud hosts, APIs, accounting integrations. Good partners know the answer.
5. What does your contract say about all of this? If the answer is nothing, that is the answer.
Frequently Asked Questions
Was my business affected by Black October?
Probably not directly, and if we manage your systems and had any concerns, you'd already have heard from us. The point isn't that your business was hit. It's that the same weaknesses (stolen keys, unpatched software, compromised updates) are what attackers go after in businesses of every size.
Is cloud-based software like WorkflowMAX or Xero safe?
Major platforms invest heavily in security, and they're generally far safer than a server in a cupboard. The risk is usually in the connections between systems: the keys, integrations and custom scripts that link them. That's where careful scoping and rotation make the difference.
What's an API key, and why does it matter so much?
It's essentially a password that lets one system talk to another. If it's stolen, the thief can do whatever that key is allowed to do. That's why we limit each key to the bare minimum and rotate them regularly.
What are our obligations if there's a data breach?
In New Zealand, the Privacy Act 2020 requires notification of serious privacy breaches, and in Australia the Notifiable Data Breaches scheme applies where relevant. Each party meets its own obligations, and we make sure you've got what you need, quickly, to meet yours. (This is general information, not legal advice.)
Where is my data stored?
We disclose our hosting providers and regions so you can do your own due diligence, we give 30 days' notice before material changes, and we can accommodate data residency requirements, for example if you work with government-adjacent clients who need NZ or Australian data centres.
Can you review how our systems are connected?
Yes. Our systems review looks at how your platforms, integrations and automations fit together, and where the weak links are.
Worried about how your systems are connected, who has access to what, or what would happen in the first hour of an incident?
That's exactly the kind of thing we help with at ConTech Solutions. No obligation, no jargon, no scare tactics. Just a straight conversation about where you stand. Drop us a message and let's chat.