New Zealand central bank's file sharing vendor breached

Accellion, a third-party secure file sharing supplier for the Reserve Bank of New Zealand, was breached in a cyberattack. 

In its official statement of the incident, RBNZ said that the File Transfer Application (FTA) supplied by Accellion was illegally accessed. The RBNZ uses this application to store sensitive information.

“We have been advised by the third-party provider that this wasn’t a specific attack on the Reserve Bank, and other users of the file sharing application were also compromised.” The RBNZ said in its statement.

Details of the incident remain concealed at this time to protect investigation efforts.

“We recognise the public interest in this incident however we are not in a position to provide further details at this time.”

“Providing any further details at this early stage could adversely affect the investigation and the steps being taken to mitigate the breach. The Reserve Bank will continue to work with affected stakeholders directly.”

The RBNZ has, however, disclosed that the compromised data may include some commercially and personally sensitive information.

The burgeoning prevalence of third-party attacks exposes a concerning vulnerability amongst vendor networks to data breaches. Because vendors require access to sensitive data to integrate with their partners, a single compromised vendor could result in multiple organizations suffering a data breach.

The RBNZ disclosed that multiple parties were impacted by the Accellion data breach.

“We have been advised by the third party provider that this wasn’t a specific attack on the Reserve Bank, and other users of the file sharing application were also compromised.”

The ubiquitous supply chain attack against the U.S Government impacted up to 18,000 customers of the comprised vendor SolarWinds. 

This incident is the second government entity to fall victim to a third-party data breach this week. A possible prelude to the pervasiveness of third-party breaches in 2021, and a desperate call for organizations to strengthen the security posture of their vendor network.