Reserve Bank of New Zealand Accellion FTA breach

On Christmas Day 2020, attackers breached the Reserve Bank of New Zealand (Te Pūtea Matua) by exploiting a zero-day vulnerability in the Accellion File Transfer Appliance (FTA), a legacy third-party tool the central bank used to share and store files with external partners. It became one of the most prominent victims of a global campaign against the ageing Accellion product.

What happened

The Accellion FTA was a roughly twenty-year-old file-transfer appliance that the Reserve Bank used for secure file transfer, storage, and collaboration — meaning a large volume of inbound and outbound information passed through it. In December 2020, attackers chained a set of zero-day vulnerabilities (CVE-2021-27101 through CVE-2021-27104) to gain access to FTA instances worldwide and exfiltrate the files they held.

Security vendor FireEye had warned Accellion as early as 16 December 2020 that the flaw was being actively exploited, and patches existed. But, according to a post-mortem by KPMG, Accellion's email alerting tool failed to send the notifications, so the Reserve Bank was not informed until 6 January 2021 — nearly two weeks after the 25 December intrusion.

Impact

• The compromised system held commercially and personally sensitive information belonging to the Bank and its stakeholders.
• The Bank could not immediately quantify exactly what had been taken, given the volume of data the FTA had handled.
• Governor Adrian Orr publicly apologised, acknowledging the Bank had been let down by its supplier and by its own oversight of the legacy system.
• The Reserve Bank estimated the total breach-response cost at around NZ$3.5 million, covering forensic investigation, the KPMG review, and remediation.

Attribution

The Reserve Bank was one of dozens of organisations worldwide — including government agencies, universities, and corporations — hit through the same Accellion FTA vulnerabilities. The broader campaign was widely linked by researchers to the financially motivated FIN11 group and the Clop extortion operation, which used the stolen data for leak-site extortion against other victims.

Why it matters

The breach is a textbook case of third-party and legacy-software risk. A central bank — an institution expected to hold the highest security standards — was compromised not through its core systems but through an end-of-life appliance from a single vendor whose own warning mechanism failed. It pushed New Zealand's public sector to accelerate the retirement of unsupported software, tighten supplier-assurance requirements, and treat third-party file-transfer tools as critical attack surface.