The Reserve Bank of New Zealand, the country’s central bank, has been hacked and commercially and personally sensitive information is believed to have been stolen.

The news of the hack was released Sunday local time and is said to have involved the breach of a third-party file sharing service used by the bank to share and store sensitive information. The hack did not affect the bank’s main functions, which are described as remaining “sound and operational.”

“We are working closely with domestic and international cybersecurity experts and other relevant authorities as part of our investigation and response to this malicious attack,” RBNZ Governor Adrian Orr said in a statement. “The nature and extent of information that has been potentially accessed is still being determined, but it may include some commercially and personally sensitive information,”

The affected system has been secured and taken offline pending an investigation.

Although the details of the form of hack and who was behind it have not been released by the bank, speculation has already emerged that the hackers may have been acting on behalf of a foreign government. “Ultimately if you were coming from a sort of like criminal perspective, the government agencies aren’t going to pay your ransom or whatever, so you’d be more interested probably coming in from a government to government level,” Dave Parry, professor of Computer Science at Auckland University, told Radio New Zealand.

Exactly which country would want to hack New Zealand is not clear, however. It has mostly managed to stay out of the trade war between Australia and China but notably criticized the Middle Kingdom over an inflammatory tweet targeting Australia in November. Chinese state-owned media responded by criticizing New Zealand Prime Minister Jacinda Ahern and said she was “like bleating sheep.” China has yet to target New Zealand with trade sanctions, but Australia and New Zealand are close allies.

The hack of RBNZ comes after the New Zealand Stock Exchange was targeted in a distributed denial-of-service attack in August that caused the the country’s main board, the NZX Debt Market and Fonterra Shareholders Market, to halt trading. That attack was described as coming from “offshore.”

Photo: Kaihsu Tai/Wikimedia Commons