What happened
In December 2020 a third-party file-transfer application (Accellion FTA) used by the Reserve Bank of New Zealand was illegally accessed, exposing commercially and personally sensitive information held in that service [rbnz]. RBNZ notified the Office of the Privacy Commissioner on 9 January 2021 and disclosed the breach publicly in January 2021 [opc-rbnz-cn], [rbnz]. The Bank commissioned an independent review. In September 2021 the Privacy Commissioner issued its first-ever compliance notice, finding RBNZ had failed to adequately protect personal information under Information Privacy Principle 5 [opc-rbnz-cn]. The number of individuals affected was not officially quantified and is not estimated here.
Timeline
- 2020-12 — Accellion FTA file-transfer service compromised (global supply-chain attack) [rbnz].
- 2021-01-09 — RBNZ notified the Office of the Privacy Commissioner [opc-rbnz-cn].
- 2021-01 — RBNZ publicly disclosed the breach and began its response [rbnz].
- 2021-09-15 — Privacy Commissioner issued a compliance notice to RBNZ for breaching IPP5 [opc-rbnz-cn].
- 2022-09 — The compliance notice was closed after RBNZ made all required changes [rbnz-cn-closed].
Current status
Resolved. The Privacy Commissioner issued a compliance notice (September 2021) after finding RBNZ failed to adequately protect personal information under IPP5; the notice was closed in September 2022 after RBNZ made all required changes [opc-rbnz-cn], [rbnz-cn-closed].
Why it matters
A textbook supply-chain breach: the Bank itself wasn’t hacked directly — a widely-used file-transfer tool was — showing how third-party software can expose even a central bank. It also produced the first compliance notice under New Zealand’s Privacy Act 2020.