New Zealand central bank says data system hacked, sensitive information potentially accessed

[mood]

New Zealand central bank says data system hacked, sensitive information potentially accessed
Investigation launched into "malicious attack," said Governor Adrian Orr.

 

jrwasserman / Getty Images/iStockphoto

 

WELLINGTON, New Zealand — New Zealand’s central bank said Sunday that one of its data systems has been breached by an unidentified hacker who potentially accessed commercially and personally sensitive information.

 

A third party file sharing service used by the Reserve Bank of New Zealand to share and store sensitive information had been illegally accessed, the Wellington-based bank said in a statement.

 

Governor Adrian Orr said the breach has been contained. The bank’s core functions “remain sound and operational,” he said.

“We are working closely with domestic and international cybersecurity experts and other relevant authorities as part of our investigation and response to this malicious attack,” Orr said.

“The nature and extent of information that has been potentially accessed is still being determined, but it may include some commercially and personally sensitive information,” Orr added.

 

The system had been secured and taken offline until the bank completes its initial investigations.

“It will take time to understand the full implications of this breach and we are working with system users whose information may have been accessed,” Orr said.

 

The bank declined to answer emailed questions seeking more details.

 

It's unclear when the breach took place or if there were any indications of who was responsible, and in what country is the file sharing service based.

 

Several major organizations in New Zealand have been the target of cyber interference in the past year, including the New Zealand Stock Exchange, which had its servers knocked out of public view for nearly a week in August.

 

Dave Parry, professor of computer science at Auckland University, told Radio New Zealand that another government was likely behind the bank data breach.

“Ultimately if you were coming from a sort of like criminal perspective, the government agencies aren’t going to pay your ransom or whatever, so you’d be more interested probably coming in from a government-to-government level,” Parry said

 

 

Source: New Zealand central bank says data system hacked, sensitive information potentially accessed

[mood]

New Zealand Reserve Bank breached using bug patched on Xmas Eve

 

 

A recent data breach at the Reserve Bank of New Zealand, known as Te Pūtea Matua, was caused by attackers exploiting a critical vulnerability patched the same day.

 

Over the weekend, the Reserve Bank disclosed that they suffered a data breach after an attacker hacked a third-party file sharing service containing sensitive data.

 

In a new advisory released yesterday, the Bank states that the attackers breached their Accellion FTA file sharing service.

"A third party file sharing service provided by Accellion called FTA (File Transfer Application), used by the Bank to share and store some sensitive information, was illegally accessed." 

"The system has been secured and taken offline while investigations are underway," the Reserve Bank stated in a new advisory.

 

Accellion FTA is a legacy service deployed on-premise to share sensitive files with external recipients securely.

 

A statement released by Accellion yesterday states that they became aware of a vulnerability in their legacy FTA service in mid-December, and a patch was deployed to all customers.

"In mid-December, Accellion was made aware of a P0 vulnerability in its legacy File Transfer Appliance (FTA) software. Accellion FTA is a 20 year old product that specializes in large file transfers."

"Accellion resolved the vulnerability and released a patch within 72 hours to the less than 50 customers affected," Accellion stated in a press release.

 

Sources in the cybersecurity industry had told BleepingComputer that the timeframe behind the released patch and when the attack on RBNZ occurred was too short to apply the patch effectively.

 

According to our sources, Accellion released the patch on December 24th, 2020, and that the Reserve Bank of New Zealand suffered the breach on December 25th.

 

With there being a 21 hour time difference between Accellion's California location and New Zealand, the breach likely occurred at around the same time or before the patch was released.

All of this occurring over the Christmas holiday further exacerbated the issue.

 

While Accellion has stated that they continue to support the legacy FTA application, based on Internet Archive snapshots, Accellion has been advising customers to migrate to their new Kiteworks platform since at least December 2019.

 

BleepingComputer has contacted both the Reserve Bank and Accellion with further questions but has not received a response.

 

 

Source: New Zealand Reserve Bank breached using bug patched on Xmas Eve