Skip to main contentSkip to navigationSkip to navigation
A security guard stands outside the main entrance to the Reserve Bank of New Zealand in central Wellington
Hack at reserve bank came months after a cyberattack on New Zealand’s stock exchange. Photograph: David Gray/Reuters
Hack at reserve bank came months after a cyberattack on New Zealand’s stock exchange. Photograph: David Gray/Reuters

New Zealand reserve bank governor apologises over 'serious' cyberattack

This article is more than 3 years old

Breach at reserve bank had ‘significant data implication’, Adrian Orr says, but that system is open for business again

The head of the Reserve Bank of New Zealand (RBNZ) has apologised after a recent cyberattack led to a serious data breach at the central bank, and brought in an independent investigator to review the incident.

The breach was first announced on Sunday and later in the week the RBNZ said a file sharing service provided by California-based Accellion had been illegally accessed.

The breach came just months after New Zealand’s stock exchange operator was targeted in a series of distributed denial of service attacks that overwhelmed its website, preventing trading for several days.

“I own this issue and I am disappointed and sorry,” said governor Adrian Orr, adding that the ongoing investigation showed the breach was “serious and has significant data implication.”

“While a malicious third party has committed the crime, and we believe service provisions have fallen short of our agreement, the bank has also fallen short of the standards expected by our stakeholders.”

Accellion said in response to a media query this week that it was made aware of the vulnerability of its legacy File Transfer Appliance (FTA), a 20-year old product that specialises in large file transfers, in mid-December.

“Accellion resolved the vulnerability and released a patch within 72 hours to the less than 50 customers affected,” it said in a statement sent to Reuters on Tuesday.

RBNZ has said the system that was breached has been secured and closed, and New Zealand’s financial system remains sound and open for business.

Dave Parry, professor of computer science at Auckland University of Technology, said the time difference between identifying the issue, making a patch and communicating it had allowed the hackers to act.

“The hackers were simply faster,” he said. Parry said RBNZ was aware of risks to its IT infrastructure and could have upgraded the 20-year old FTA software, but that it was not a terrible error as the systems were still working.

Apart from the forensic cyber investigation underway, the bank also appointed an independent third party to undertake a review of the incident. Orr said he could not provide any further details as it could adversely affect the investigation and the steps being taken to mitigate the breach.

Most viewed

Most viewed