(Reuters) – The head of the Reserve Bank of New Zealand apologized on Friday after a new cyber attack recently led to a serious data breach in the central bank and brought in an independent investigator to investigate the incident.
was first announced on Sunday and later this week, RBNZ said a file-sharing service provided by California-based Accellion was illegal access. of service attacks that overwhelmed their website and prevented trading for several days.
"I own this question and I am disappointed and sorry," said Governor Adrian Orr, adding that the ongoing investigation showed that the violation is "serious and has significant data implication."
"Although a harmful third party has committed the crime, and we believe that service terms have fallen short of our agreement, the bank has also fallen short of the expected standards
Accellion said in response to a media question this week that it became aware of the vulnerability of its older File Transfer Appliance, a 20 year-old product specializing in large file transfers, mid-December.
"Accellion resolved the vulnerability and released a patch within 72 hours to the less than 50 affected customers," it said in a statement sent to Reuters on Tuesday.
RBNZ has said that the system that was broken has been secured and closed, and New Zealand's financial system remains sound and open for business.
Dave Parry, Professor of Computer Science at the Auckland University of Technology, said the time difference between identifying the issue, making a patch and communicating it enabled hackers to act.
"Hackers were simply faster," he said.
Mr. Parry said that RBNZ was aware of the risks of its IT infrastructure and could have upgraded the 20-year-old FTA software, but that it was not a terrible error because the systems were still working.
Apart from the ongoing forensic investigation, the bank also appointed an independent third party to conduct an investigation into the incident.
Mr. Orr said he could not provide any further details as it could affect the investigation and the measures taken to mitigate the breach. Catalog