Reserve Bank says it now knows scope of data theft

Reserve Bank Governor Adrian Orr: "I am disappointed and sorry this data theft has occurred." Photo / Mark Mitchell

The Reserve Banks says its investigation into a data breach over Christmas has "significantly progressed."

Governor Adrian Orr said in a statement this afternoon: "With the assistance of New Zealand and international police, and forensic security specialists, the cause of the breach is now understood and resolved. The system is closed.

"Significantly, we have a good understanding of the scope of the breach.

"Based on the results of our investigation and analysis to date we have been able to tell stakeholders which of their files on the File Transfer Application (FTA) were downloaded illegally during the breach.

"This prioritised analysis is continuing and we are supporting stakeholders to manage risks and respond appropriately."

The RBNZ did not immediately respond to questions about the type of data accessed, or the organisations or - possibly - individuals whose information was exposed.

Last week, the bank said the breach "may include some commercially and personally sensitive information".

"We are also keeping the Office of the Privacy Commissioner regularly informed and we're taking its guidance," Orr said in this afternoon's statement.

"The bank's core functions are unaffected, sound and operational.

"I'm pleased with the way the bank has stepped up in responding to this breach, and I'm thankful for the support of our public and private sector partners, but I am disappointed and sorry this data theft has occurred.

"There are some serious questions that have been answered by the team at the bank and there are more for the supplier of the system that was breached. That is the subject of an independent review by KPMG that is now underway.

"I will provide an update on the review process next week."

An internal report published last May warned the RBNZ that it was under-investing in security and using outdated tools.

The US supplier of the 20-year-old FTA file sharing service, Accellion, had also been trying to encourage the Reserve Bank and other customers to upgrade to its newer, more secure Kiteworks. The RBNZ was one of a small minority of Accellion customers still on the old system.

There are also questions over the timeline of the immediate breach. One cyber security insider told the Herald the RBNZ and other Accellion clients were supplied a patch for the security issue by December 24, but the bank did not act until January 7.

The Reserve Bank also said today that it was delaying publication of most statistical releases in the wake of the security breach.

"We will provide an updated release calendar when we can, but we expect delays of three to four weeks," it said in statement.