Skip to main content
Access every election story that matters
Enjoy unlimited digital access
$1.99
per week for 24 weeks
Access every election story that matters
Enjoy unlimited digital access
$1.99
per week
for 24 weeks
// //

Reserve Bank of New Zealand Governor Adrian Orr speaks to the media in Wellington on May 8, 2019.

Nick Perry/The Associated Press

The head of the Reserve Bank of New Zealand (RBNZ) apologized on Friday after a recent cyberattack led to a serious data breach at the central bank, and brought in an independent investigator to review the incident.

The breach was first announced on Sunday and later in the week the RBNZ said a file sharing service provided by California-based Accellion was illegally accessed.

The breach comes just months after New Zealand’s stock exchange operator was targeted in a series of distributed denial of service attacks that overwhelmed its website, preventing trading for several days.

Story continues below advertisement

“I own this issue and I am disappointed and sorry,” said Governor Adrian Orr, adding that the ongoing investigation showed the breach is “serious and has significant data implication.”

“While a malicious third party has committed the crime, and we believe service provisions have fallen short of our agreement, the Bank has also fallen short of the standards expected by our stakeholders.”

Accellion said in response to a media query this week that it was made aware of the vulnerability of its legacy File Transfer Appliance (FTA), a 20-year old product that specializes in large file transfers, in mid-December.

“Accellion resolved the vulnerability and released a patch within 72 hours to the less than 50 customers affected,” it said in a statement sent to Reuters on Tuesday.

RBNZ has said the system that was breached has been secured and closed, and New Zealand’s financial system remains sound and open for business.

Dave Parry, Professor of Computer Science at Auckland University of Technology, said the time difference between identifying the issue, making a patch and communicating it allowed the hackers to act.

“The hackers were simply faster,” he said.

Story continues below advertisement

Parry said RBNZ was aware of risks to its IT infrastructure and could have upgraded the 20-year old FTA software, but that it was not a terrible error as the systems were still working.

Apart from the forensic cyber investigation underway, the bank also appointed an independent third party to undertake a review of the incident.

Orr said he could not provide any further details as it could adversely affect the investigation and the steps being taken to mitigate the breach.

Be smart with your money. Get the latest investing insights delivered right to your inbox three times a week, with the Globe Investor newsletter. Sign up today.

Your Globe

Build your personal news feed

  1. Follow topics and authors relevant to your reading interests.
  2. Check your Following feed daily, and never miss an article. Access your Following feed from your account menu at the top right corner of every page.

Follow topics related to this article:

View more suggestions in Following Read more about following topics and authors
Report an error
Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

If you do not see your comment posted immediately, it is being reviewed by the moderation team and may appear shortly, generally within an hour.

We aim to have all comments reviewed in a timely manner.

Comments that violate our community guidelines will not be posted.

UPDATED: Read our community guidelines here

Discussion loading ...

To view this site properly, enable cookies in your browser. Read our privacy policy to learn more.
How to enable cookies