Attackers who had compromised Bangladesh Bank used its access to the SWIFT interbank messaging network to send fraudulent payment instructions to the Federal Reserve Bank of New York. Most of the requests were blocked, but $81m reached accounts in the Philippines and largely vanished.
What happened
- Over the weekend of 4 to 5 February 2016, fake transfer orders worth close to $1bn were sent from the central bank’s account at the New York Fed.
- About $81m was paid into accounts at a branch of Rizal Commercial Banking Corporation in Manila and was then moved through the Philippine casino industry.
- The attackers used malware to hide the fraudulent messages from bank staff, and the theft only became public weeks later.
- In 2018 the US Department of Justice charged a North Korean programmer, alleging the heist was part of a campaign by a North Korean government-backed group.
Why it mattered
It was one of the largest cyber thefts ever recorded and showed that trusted financial messaging systems were only as secure as the endpoints connected to them. SWIFT responded with a customer security programme for its members.
Lessons for organisations
Critical payment systems need strong segregation, multi-factor authentication, and independent reconciliation so that fraudulent transactions are spotted quickly. Monitoring for tampering with logs and reporting tools is as important as protecting the transactions themselves.
Sources: Insurance Journal (Reuters), US Department of Justice
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
