When a supplier gets hacked: what the 2021 Reserve Bank of New Zealand breach teaches

What third-party risk means

Almost every organisation relies on outside suppliers: software, file-sharing services, payment processors, cloud hosts, IT contractors. Each one holds, or can reach, some of your data. If a supplier is hacked, your data can be taken even though nothing was wrong with your own systems. This is called third-party or supply chain risk, and it is a growing part of the picture. The 2025 Verizon Data Breach Investigations Report found that the share of breaches involving a third party doubled to about 30%.

For individuals, the effect is the same from the other side. You hand your details to a company, and it stores them with other companies you have never heard of. A breach at any link in that chain can reach you.

What happened: the short version

The case involves a file-transfer product called the Accellion File Transfer Appliance (FTA). TechTarget described it as a roughly 20-year-old legacy product that the vendor was planning to retire. Many organisations used it to send large files securely.

1. Mid-December 2020. Attackers began exploiting a previously unknown flaw (a “zero-day”) in the FTA. A report by the security firm FireEye, commissioned by Accellion, put the first exploitation at December 16, 2020. The attacks were publicly disclosed in late December.
2. Early January 2021. Accellion issued fixes. According to KPMG’s later review, Accellion’s email system failed to send its update notifications, so the Reserve Bank was not told until January 6, 2021. The bank applied the updates on January 7 and began checking for a breach. KPMG said the fix was applied within 24 hours of the notice.
3. January 10, 2021. RBNZ publicly disclosed that it had been the victim of a breach of the system, which it used to share information with stakeholders. Governor Adrian Orr said he “personally owns” responsibility for the breach.
4. February 2021. RBNZ said personal information had been stolen. It listed dates of birth, credit details and personal email addresses. It did not say who was affected or give an exact list of what was taken, and the breach caused delays to its regular data releases.

RBNZ said its day-to-day operations, including market operations and cash and payment systems, were not affected.

It was not only the central bank

The Reserve Bank was one of many victims. Reports listed organisations across government, finance, health, law, energy and retail. Among those named in coverage were the Australian Securities and Investments Commission (ASIC), Transport for New South Wales, the Canadian aircraft maker Bombardier, the supermarket group Kroger, and the law firms Jones Day and Goodwin, as well as other companies.

Security firm Mandiant tracked the group behind the attacks as UNC2546, which it linked to the Clop ransomware group. Some stolen data later appeared on the group’s leak website, and several victims received extortion emails. A joint advisory from agencies in the US, Australia, New Zealand, Singapore and the UK also warned about the exploitation.

The pattern, one supplier flaw and many victims, was repeated in later cases such as the 2023 MOVEit mass hack, which we cover in our round-up of the biggest scams and hacks.

What the independent review found

The Reserve Bank commissioned KPMG to review its response. The findings, as reported, were not just about the supplier. They included problems on the bank’s own side:

• The system was used for more than it was meant for. It was supposed to be for secure file transfers, but was also used as an information store and for collaboration, against the bank’s own 2014 acceptable-use guidelines. KPMG said following the rules would have significantly reduced the information at risk.
• Warnings were missed. Default alerts for possible malicious activity had been active since 2015, and alerts appeared in December 2020, but they were not followed up.
• No formal risk check. The system had never been through a certification and accreditation process, which might have identified the risks of how it was being used.
• The supplier did not say it was already being exploited. KPMG found no evidence that Accellion told the bank the flaw was being actively exploited against other customers.
• Over-reliance on the supplier. Governor Orr said the bank had relied too much on Accellion for vulnerability warnings, accepted the findings, and said the bank “takes full responsibility” for its shortfalls. He apologised to those affected.

KPMG’s recommendations included more frequent incident drills, stronger security training and monitoring, a formal security strategy, updated rules for critical applications, clear communication with suppliers, a data classification standard and a framework for managing third-party risk.

The lessons for any organisation

1. Know what suppliers hold. Keep a list of the services that touch your data, and what each one stores.
2. Limit what goes in. A file-transfer tool should transfer files, not become a permanent store. The less data a system holds, the less there is to lose.
3. Delete data you no longer need. Old files that were never cleared out were part of the exposure in this case.
4. Do not rely on the supplier to warn you. Check security bulletins yourself, and have a clear way for suppliers to reach a real person.
5. Act on alerts. A warning that nobody reads is worse than no warning, because it feels like protection.
6. Retire old products. Legacy software that is no longer supported is a standing risk.
7. Practise for a bad day. Know in advance who decides, who calls whom and what gets switched off.
8. Ask suppliers hard questions about their security, patching and how and when they will tell you about a problem.

What this means for you as an individual

You cannot audit the companies that hold your data, but you can limit the effect when one of them is breached:

• Use a different password for every account, with a password manager, so one breach does not unlock others.
• Turn on two-factor authentication wherever it is offered.
• Be wary of messages after a breach announcement that quote your real details and ask you to click or pay. The data in them may be real, but the message is not. Our phishing checker helps.
• Consider a credit freeze if sensitive details such as your date of birth or credit information are involved.
• Share only what a service really needs.

Our guide to how data breaches actually happen goes deeper into what happens to stolen data afterwards.

Sources

• interest.co.nz: KPMG report on the RBNZ cyber attackAccessed October 13, 2026
• BankInfoSecurity: NZ Reserve Bank governor says he “owns” breachAccessed October 13, 2026
• TechTarget: Accellion FTA attacks claim more victimsAccessed October 13, 2026
• Verizon 2025 Data Breach Investigations Report (press release summary)Accessed October 13, 2026

Published October 13, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.