The Reserve Bank of New Zealand (Te Pūtea Matua) is responding to a breach of a third-party file sharing service used to share information with external stakeholders.
Governor Adrian Orr says the breach is contained but it will take time to determine the impact.
“We are actively working with domestic and international cybersecurity experts and other relevant authorities as part of our investigation. This includes the GCSB’s National Cyber Security Centre which has been notified and is providing guidance and advice,” he said.
“We have been advised by the third-party provider that this wasn’t a specific attack on the Reserve Bank, and other users of the file sharing application were also compromised.
Kevin Reed, CISO at Acronis, said: “There’s no way to trace the breach back to the perpetrator until the investigation is complete – it could be anything between a state sponsored attack or a simple automated attack on a misconfigured server/system.
“However, government entities aren’t known for paying ransoms, so threatening to leak data will likely not be profitable for the attacker – their goal could be simply to create mayhem.
“One way this could happen is if an employee of the third-party file sharing service fell victim to a phishing or malspam attack that resulted in either stolen credentials or installation of a trojan, which provided access to the systems.”
