Bangladesh sues Philippine bank over cyberheist at New York Fed

Bangladesh’s central bank on Thursday sued a Philippine bank to recoup losses it suffered when unidentified hackers stole $81 million from its account at the Federal Reserve Bank of New York nearly three years ago.

In a complaint filed with the US District Court in Manhattan, Bangladesh Bank accused Rizal Commercial Banking Corp (RCBC) and dozens of others, including several top executives, of involvement in a “massive” and “intricately planned” multi-year conspiracy to steal its money.

Bangladesh Bank said funds were stolen with the help of unnamed North Korean hackers who used malware with such names as “Nestegg” and “Macktruck” to obtain backdoor access its network.

It said funds were then funnelled through RCBC accounts in New York City and to the Philippines, where much of it disappeared in that country’s casino industry.

RCBC did not immediately respond to a request for comment after market hours.

It had said on Wednesday, after learning the lawsuit would be filed: “We welcome this complaint, as it is an opportunity for RCBC to put on record again that it was a victim of what was started in Bangladesh by still unnamed persons.”

The case arose from a February 2016 incident when hackers tricked the New York Fed into sending out the $81 million.

Funds eventually landed in four accounts held in fake names at an RCBC branch in Makati City. Much of it was quickly withdrawn, and only about $15 million has been recovered.

RCBC, based in Manila, has contended that the theft was an inside job and accused Bangladesh Bank of a cover-up.

Fazle Kabir, governor of Bangladesh Bank, said on Wednesday the New York Fed had signed an agreement to help with the case.

A New York Fed spokeswoman declined to discuss what support her office might offer.

The hackers sought to steal close to $1 billion, but ultimately stole $101 million, including $20 million sent to a Sri Lankan account. That transfer was reversed after a spelling error was caught.

On Jan 10, a Philippine court found Maia Deguito, who managed RCBC’s Makati City branch, guilty of eight counts of money laundering tied to the heist. It sentenced her to a 32- to 56-year prison term and a $109 million fine.

Deguito is a defendant in Thursday’s lawsuit. Her lawyer could not immediately be reached for comment.

In August 2016, the Philippine central bank fined RCBC a record 1 billion pesos ($19 million) for failing to stop stolen money from moving through the bank.

The case is Bangladesh Bank v Rizal Commercial Banking Corp et al, US District Court, Southern District of New York, No. 19-00983.