Reserve Bank releases reports into illegal data breach

The Reserve Bank of New Zealand has released the findings of independent reports on an illegal data breach and its handling of sensitive information.

Reserve Bank governor Adrian Orr says the bank accepts the findings and has, and will continue to, implement recommendations in the report.

Orr says the bank is well advanced on investment initiatives related to its digital systems and data management and has prioritised the initiatives consistent with the recommendations outlined in the reports.

On December 25, 2020 the Reserve Bank was the victim of a cyber-attack on the third-party file-sharing application it used to share and store information.

KPMG was subsequently engaged to complete an independent review of the bank’s immediate response to the breach, and identify areas for improvements in the bank’s systems and processes.

“While we were the victim of a widespread illegal attack on the file-sharing system, the Reserve Bank takes full responsibility for our shortfalls identified in the KPMG report,” Orr says.

The bank estimates the final cost of the breach response, including internal resources, will be around $3.5 million.

For a copy of the KPMG report click here.

For a copy of the Deloitte report click here.