Court lifts FIMBank €840,000 garnishee after cyber-attack

A court has revoked an €840,000 garnishee against FIMBank by a Swiss-based company, after an alleged cyber-attack saw the bank transfer the company’s money to a third party instead of its intended recipient.

FIMBank was hit with the €841,941 garnishee in June 2020 after having issued a wrongful payment on instructions of Acemar AG. Subsequently it was found that Acemar had been hacked, and the instructions had been sent by the hacker. Acemar alleged that the bank was negligent in transferring the money.

Acemar told the court it had instructed FIMBank to transfer $950,000 from its account to a Swiss bank account held by the same company. But subsequent instructions to transfer the money to a Croatian bank – and not to the Swiss account – were later found to have been made by someone who had hacked communications between the two parties, and directed FIMBank to transfer the money to the Croatian account.

The bank steadfastly refused to accept liability, leading to the garnishee request from Acemar.

Mr Justice Lawrence Mintoff observed that the garnishee was filed after a phishing or hacking attack on the computer systems of one of the parties, although it was unclear which party had suffered the breach.

Acemar accused FIMBank of being negligent in processing instructions, and expressed concern that the bank had never promised to repay the money.

FIMBank argued there was no risk to Acemar’s credit, and that the presumption should be in favour of the liquidity of the bank. It said the garnishee was affecting its day-to-day operations and relationship with other banks.

This was one of the considerations taken into account by the court, which said that it could not ignore the effects of the garnishee and FIMBank’s ability to function commercially after being hit with a short-order demand for over €800,000.

The court ordered the garnishee’s revocation.