Bangladesh central bank weighs lawsuit against NY Fed over cyber heist

Commuters pass by the front of the Bangladesh central bank building in Dhaka March 8, 2016.

Reuters/Ashikur Rahman

Bangladesh’s central bank has hired a lawyer in the United States for a potential lawsuit against the New York Federal Reserve after unknown hackers stole $81 million from its account with the U.S. bank, an internal report said.

In one of the largest cyber heists in history, the hackers breached the computer systems of Bangladesh Bank (BB) in early February and succeeded in issuing instructions to the New York Fed to transfer $81 million to accounts in the Philippines.

The hackers also tried to move $20 million to an obscure non-profit entity based in Sri Lanka but that transaction was halted because they misspelt the recipient’s name.

The heist has prompted the resignation of Bangladesh’s central bank governor, Atiur Rahman, and the U.S. Federal Bureau of Investigation (FBI) is now helping the country to track down the cyber crooks.

BB said in an incident report dated March 13 that it had been the subject of a sophisticated cyber-attack in which 35 payment instructions were issued to the New York Fed. Of those the U.S. bank blocked 30 while allowing the rest to go through.

“We view this as a major lapse on the part of FRB NY,” BB said in the report, a copy of which was obtained by Reuters.

It said the bank was considering “preparing the ground to make a legitimate claim for the loss of funds against the FRB NY through a legal process”.

A source at the central bank confirmed the authenticity of the report.

The New York Fed has said it followed normal procedures in allowing the transfer of the funds and that there was no evidence that its own systems had been compromised.

Bangladesh police are still collecting information from the central bank’s computer systems to determine who was behind the heist. In its report, BB said it was pursuing all avenues to recover the money.

In Sri Lanka, a court has imposed a travel ban on six directors of the Shalika Foundation to which the hackers transferred money, a lawyer said on Tuesday.

The transfer of $20 million, ostensibly for a rural electrification project, was held up because the hackers had spelt the entity as Shalika “Fandation”.

Shalika, based near the capital Colombo, is headed by Hagoda Gamage Shalika Perera and her residential address was also given as the firm’s address. Calls to her and another director went unanswered.

(Additional reporting by Shihar Aneez in COLOMBO; Writing by Sanjeev Miglani; Editing by Gareth Jones)