{
	"id": "4a8f2f2d-240d-4cae-a039-b0ceef4da509",
	"created_at": "2026-04-06T00:19:20.134253Z",
	"updated_at": "2026-04-10T03:21:15.089311Z",
	"deleted_at": null,
	"sha1_hash": "37ab67d41ed7a034269b575af7be8aad09253ac3",
	"title": "New Zealand Reserve Bank breached using bug patched on Xmas Eve",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 3112962,
	"plain_text": "New Zealand Reserve Bank breached using bug patched on Xmas Eve\r\nBy Lawrence Abrams\r\nPublished: 2021-01-12 · Archived: 2026-04-05 20:36:56 UTC\r\nA recent data breach at the Reserve Bank of New Zealand, known as Te Pūtea Matua, was caused by attackers exploiting a\r\ncritical vulnerability patched the same day.\r\nOver the weekend, the Reserve Bank disclosed that they suffered a data breach after an attacker hacked a third-party file\r\nsharing service containing sensitive data.\r\nIn a new advisory released yesterday, the Bank states that the attackers breached their Accellion FTA file sharing service.\r\nhttps://www.bleepingcomputer.com/news/security/new-zealand-reserve-bank-breached-using-bug-patched-on-xmas-eve/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/new-zealand-reserve-bank-breached-using-bug-patched-on-xmas-eve/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\n\"A third party file sharing service provided by Accellion called FTA (File Transfer Application), used by the Bank to share\r\nand store some sensitive information, was illegally accessed.\" \r\n\"The system has been secured and taken offline while investigations are underway,\" the Reserve Bank stated in a new\r\nadvisory.\r\nAccellion FTA is a legacy service deployed on-premise to share sensitive files with external recipients securely.\r\nA statement released by Accellion yesterday states that they became aware of a vulnerability in their legacy FTA service in\r\nmid-December, and a patch was deployed to all customers.\r\n\"In mid-December, Accellion was made aware of a P0 vulnerability in its legacy File Transfer Appliance (FTA) software.\r\nAccellion FTA is a 20 year old product that specializes in large file transfers.\"\r\n\"Accellion resolved the vulnerability and released a patch within 72 hours to the less than 50 customers affected,\" Accellion\r\nstated in a press release.\r\nSources in the cybersecurity industry had told BleepingComputer that the timeframe behind the released patch and when the\r\nattack on RBNZ occurred was too short to apply the patch effectively.\r\nAccording to our sources, Accellion released the patch on December 24th, 2020, and that the Reserve Bank of New Zealand\r\nsuffered the breach on December 25th.\r\nWith there being a 21 hour time difference between Accellion's California location and New Zealand, the breach likely\r\noccurred at around the same time or before the patch was released.\r\nAll of this occurring over the Christmas holiday further exacerbated the issue.\r\nWhile Accellion has stated that they continue to support the legacy FTA application, based on Internet Archive snapshots,\r\nAccellion has been advising customers to migrate to their new Kiteworks platform since at least December 2019.\r\nBleepingComputer has contacted both the Reserve Bank and Accellion with further questions but has not received a\r\nresponse.\r\nhttps://www.bleepingcomputer.com/news/security/new-zealand-reserve-bank-breached-using-bug-patched-on-xmas-eve/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/new-zealand-reserve-bank-breached-using-bug-patched-on-xmas-eve/\r\nhttps://www.bleepingcomputer.com/news/security/new-zealand-reserve-bank-breached-using-bug-patched-on-xmas-eve/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/new-zealand-reserve-bank-breached-using-bug-patched-on-xmas-eve/"
	],
	"report_names": [
		"new-zealand-reserve-bank-breached-using-bug-patched-on-xmas-eve"
	],
	"threat_actors": [],
	"ts_created_at": 1775434760,
	"ts_updated_at": 1775791275,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/37ab67d41ed7a034269b575af7be8aad09253ac3.pdf",
		"text": "https://archive.orkl.eu/37ab67d41ed7a034269b575af7be8aad09253ac3.txt",
		"img": "https://archive.orkl.eu/37ab67d41ed7a034269b575af7be8aad09253ac3.jpg"
	}
}