Our response to Data Breach
This page describes how we are responding to a security breach of a standalone third-party system that we use.
In January 2021, we reported a security breach of a third-party file sharing software application that we use to share and store sensitive information. Following this malicious attack, the system has been secured and taken offline.
We are working closely with international and domestic cyber security experts and other relevant authorities as part of our investigation and response.
The nature and extent of information that has been illegally downloaded is still being determined, but it may include some commercially and personally sensitive information.
We have made good progress with ongoing forensic cyber investigations and have now begun sharing information with our stakeholders identifying which files relevant to them were illegally downloaded. This information will assist them in managing any risks.
Our core functions remain unaffected, sound, and operational.
RBNZ Governor Adrian Orr responds to the illegal breach
Receive these updates in your inbox
You can subscribe, or update your subscription, to RBNZ email updates to include FTA data breach updates.Subscribe now
Frequently asked questions
What did the security breach involve?
Accellion FTA, a third-party global file sharing software application used to share information between the Bank and its stakeholders, was maliciously and illegally accessed. During this breach, some files stored on the third-party system were illegally downloaded.
What information was accessed?
A detailed forensic cyber investigation is ongoing involving domestic and international experts. It is a complex process and, based on our investigations to date, the Bank has been able to tell stakeholders which of their files were illegally downloaded.
What do you mean when you refer to files?
When the Bank refers to files it is referring to individual submissions made by organisations to FTA. File types vary and could include Word documents, PDFs, .ZIP and other formats. That is part of the analysis that is now being undertaken.
What is the Reserve Bank doing in response to the breach?
This issue has our full attention. Accellion FTA is a standalone system and it was secured and closed quickly when the bank became aware of the breach. We were already in the process of implementing a new secure file transfer system and that work has been expedited.
A detailed forensic cyber investigation is ongoing and the Bank is supporting stakeholders to help them manage risks and take appropriate action.
While a malicious third party has committed the crime, we believe the Bank has fallen short of the standards our stakeholders set for us and we apologise for this unreservedly.
In addition to the forensic cyber investigation currently underway, the Bank has appointed KPMG to undertake a comprehensive review.
Has this impacted the Bank’s ability to operate?
The Bank’s core functions, and New Zealand’s financial system remain sound. The Bank is open for business, including market operations and management of the cash and payments system.
As an added security measure some statistics that used the software application have been put on hold while our cyber experts work through the investigation.
When will more information be made public?
The Bank will provide more information regarding this incident as and when it is appropriate to do so, being mindful not to undermine the KPMG review and criminal and forensic investigations currently underway.
Find out our latest responses and actions around this situation
For enquiries, please email firstname.lastname@example.org.