Breach taxonomy
Summary
On February 21, 2024, the Federal Home Loan Bank of New York detected an attempt by unknown persons to fraudulently obtain funds from the Bank. Investigation determined that a fourth-party vendor (a vendor of a Bank vendor) had been compromised, enabling the fraud attempt. The Bank's own IT systems and networks were not compromised, no unauthorized transactions were executed, and no funds were transferred. Bank members were able to continue transacting throughout the incident.
Tagging rationale
ThreatCyber Criminals
Filing describes an attempt to fraudulently obtain funds via a compromised vendor — consistent with financially motivated cybercriminals; no explicit attribution but financial fraud motive is clear.
MethodsSupply Chain
Filing explicitly states the incident was caused by a fourth-party vendor (a vendor of a Bank vendor) being compromised — a supply chain attack vector.
AssetsCash Equivalent
Filing describes an attempt to fraudulently obtain funds from the Bank — targeting cash or cash equivalent assets.
EffectsFinancial Fraud
The incident was a financial fraud attempt targeting the Bank's funds, though no unauthorized transactions were ultimately executed.
Business continuityNot Required
Filing states the Bank's own IT systems were not compromised and Bank members could continue to execute transactions — no operational disruption requiring continuity procedures.
Impact
Attempted financial fraud via compromised fourth-party vendor was fully prevented — no funds transferred, no systems compromised, no operational disruption.
InsuranceNot disclosed
Filing makes no mention of insurance.
Read the original SEC filing excerpt
Item 1.05 Material Cybersecurity Incidents On February 21, 2024, the Federal Home Loan Bank of New York, through its operational controls, detected unknown persons attempting to fraudulently obtain funds from the Bank. The Bank immediately activated its response process, and determined that a fourth-party vendor (i.e., a vendor of a Bank vendor) had been compromised, which caused the incident. The Bank then took prompt steps to contain and remediate the incident. The Bank's own information technology systems and networks were not compromised or affected, no unauthorized transactions were executed and no monies were transferred to the unknown persons, and Bank members were able to continue to execute transactions with the Bank. As of the date of this filing, the incident has not had a material impact on the Bank's operations, and the Bank believes the incident will not materially impact the Bank's financial condition or results of operations.