Bangladesh sues RCBC over cyberheist at New York Fed

NEW YORK — Bangladesh’s central bank on Thursday sued a Philippine bank to recoup losses it suffered when unidentified hackers stole $81 million from its account at the Federal Reserve Bank of New York nearly three years ago.
In a complaint filed with the U.S. District Court in Manhattan, Bangladesh Bank accused Rizal Commercial Banking Corp (RCBC) and dozens of others, including several top executives, of involvement in a “massive” and “intricately planned” multi-year conspiracy to steal its money.
Bangladesh Bank said funds were stolen with the help of unnamed North Korean hackers who used malware with such names as “Nestegg” and “Macktruck” to obtain backdoor access its network.
It said funds were then funneled through RCBC accounts in New York City and to the Philippines, where much of it disappeared in that country’s casino industry.
In a statement released on Friday, RCBC said the lawsuit is “completely baseless” and “nothing more than a blatant attempt by Bangladesh Bank to shift blame and cover up their own liability.”
“If the Bank of Bangladesh was serious about recovering the money, they would have pursued their claims three years ago and not wait until days before the statute of limitations. Not only are the allegations false, they don’t have the right to file here since none of the defendants are in the US,” RCBC said, quoting its lead attorney Tai-Heng Cheng of US law firm Quinn Emanuel.
The case arose from a February 2016 incident when hackers tricked the New York Fed into sending out the $81 million.
Funds eventually landed in four accounts held in fake names at an RCBC branch in Makati City. Much of it was quickly withdrawn, and only about $15 million has been recovered.
RCBC, based in Manila, has contended that the theft was an inside job and accused Bangladesh Bank of a cover-up.
“A review of the facts shows that Bangladesh Bank’s errors, omissions, and lapses in security protocols are the cause of its loss. We believe it is telling that they have concealed information from their own investigation and despite admitting their own culpability, continue to try to blame others,” RCBC said, quoting Mr. Cheng.
Fazle Kabir, governor of Bangladesh Bank, said on Wednesday the New York Fed had signed an agreement to help with the case.
A New York Fed spokeswoman declined to discuss what support her office might offer.
The hackers sought to steal close to $1 billion, but ultimately stole $101 million, including $20 million sent to a Sri Lankan account. That transfer was reversed after a spelling error was caught.
On Jan. 10, a Philippine court found Maia Deguito, who managed RCBC’s Makati City branch, guilty of eight counts of money laundering tied to the heist. It sentenced her to a 32- to 56-year prison term and a $109 million fine.
Ms. Deguito is a defendant in Thursday’s lawsuit. Her lawyer could not immediately be reached for comment.
In August 2016, the Philippine central bank fined RCBC a record P1 billion ($19 million) for failing to stop stolen money from moving through the bank.
The case is Bangladesh Bank v Rizal Commercial Banking Corp et al, U.S. District Court, Southern District of New York, No. 19-00983. — Reuters with report from BusinessWorld