Bangladesh Bank keeps its dollars at the Federal Reserve Bank of New York and speaks to the Fed through SWIFT, the network banks use to instruct one another. Late on Thursday 4 February 2016, after the Dhaka offices had closed for the Bangladeshi weekend, someone holding the bank's own SWIFT credentials sent the Fed thirty-five payment orders worth about $951 million, most of them to individuals in the Philippines and Sri Lanka. The intruders had been inside the network since at least January, and had prepared the ground: four accounts at a Manila branch of Rizal Commercial Banking Corporation had been opened under false names the previous May, and the malware on the bank's SWIFT terminal had one more job, which was to keep a printer quiet.
The printer, on the tenth floor, existed to turn SWIFT acknowledgements into paper. When Zubair Bin Huda, a joint director on weekend duty, arrived at about 10:30 on Friday morning and went to collect the overnight messages, there were none; a manual print failed, and he assumed the printer was misbehaving again. Friday being the holy day, the office had emptied by half past twelve. Queries from the Fed arrived into a system nobody could read. On Saturday the SWIFT software would not start — the screen reported a file missing or changed — and it was 12:30 in the afternoon before staff printed the backlog and saw the transfers and the Fed's questions together. An email asking the Fed to stop payment went out at 1:30, into New York's own weekend.
Luck saved the other $850 million. The Fed had cleared five orders, $101 million, before the name Jupiter set off its sanctions checks: the receiving branch was on Jupiter Street, and Jupiter, Reuters later found, was also the name of an oil tanker and a shipping company under American sanctions on Iran. The $20 million for a supposed Sri Lankan charity was queried by Deutsche Bank because the order spelled the payee Shalika Fandation, and came back. The $81 million that reached the four RCBC accounts did not. Stop-payment messages from Dhaka landed on 8 February, when Manila was closed for Chinese New Year; by the time they were frozen next morning, most of it had gone out over the counter, through a remittance firm and into the casinos.
On 16 February the governor of Bangladesh Bank wrote to the Philippine central bank for help. By then, investigators later found, the remittance firm had already handed over $18 million and 600 million pesos in cash — carried across in instalments between 5 and 13 February — to a junket agent at the Solaire casino in Manila's Entertainment City. Nothing was public until the Philippine Daily Inquirer printed the story on 29 February, the leap day; Dhaka's government learned at about the same time, a month late. Governor Atiur Rahman resigned on 15 March 2016. The junket operator Kim Wong surrendered about $15 million that spring, nearly all that ever came back. RCBC was fined a record one billion pesos in August, and the manager of its Jupiter Street branch, Maia Santos Deguito, was convicted of money laundering in January 2019 on eight counts. RCBC has said throughout that it was a victim too, that no institutional wrongdoing was involved, and that the fault lay with Bangladesh Bank's own negligence — a position it still argues in court.
A judge orders Apple to break its own lock
The iPhone 5C belonged to San Bernardino County and had been issued to Syed Rizwan Farook, one of the two attackers who killed fourteen people there in December 2015. On 16 February 2016 Magistrate Judge Sheri Pym of the federal court for central California, on the Justice Department's ex parte application under the All Writs Act of 1789, ordered Apple to write software that would disable the auto-erase that wipes the phone after ten wrong guesses and let the FBI feed in passcodes electronically. Apple's reply went up the same night, dated 16 February and on every front page by the 17th: a letter from Tim Cook calling the demand "an unprecedented step which threatens the security of our customers", and arguing that a tool to defeat one phone's lock would be a backdoor to every iPhone in anyone's physical possession. A hearing was set for 22 March, and February ended with both sides briefing for it. The case ended on 28 March, when the government said an outside party had opened the phone and withdrew — March's edition has that ending.
A hospital pays in bitcoin
Hollywood Presbyterian Medical Center, a hospital of more than 400 beds in Los Angeles, noticed on 5 February that it could not reach its own network. Ransomware had locked the electronic medical records, and for ten days the hospital ran as hospitals had a generation earlier: admissions by pen, results by fax, some patients diverted to neighbouring emergency rooms, the FBI investigating. The first reports put the demand at 9,000 bitcoin, about $3.4 million. On 17 February the president and chief executive, Allen Stefanek, corrected them in a written statement: the demand had been 40 bitcoin, roughly $17,000, and the hospital had paid it as the quickest way to get its systems back, which returned on 15 February. He said patient care had not been affected and that there was no evidence any patient data had been taken; the statement did not name the malware. The sum was small and the precedent enormous — this is the hospital ransom most people remember first. The same week Palo Alto Networks described a new strain, Locky, arriving through booby-trapped Word attachments in more than 400,000 sessions, with the delivery machinery of the Dridex banking gang.
The regulator says no to Free Basics
On 8 February 2016 the Telecom Regulatory Authority of India published the Prohibition of Discriminatory Tariffs for Data Services Regulations, 2016: a service provider may not offer or charge different prices for data according to the content a subscriber reaches, with exemptions for emergency services and closed networks, and a penalty of Rs 50,000 a day capped at Rs 50 lakh. The target everyone understood was Free Basics, Facebook's zero-rated bundle of approved sites, launched with Reliance Communications a year earlier and defended through the winter with full-page advertisements and a one-tap petition pushed to every Indian user. The next day Marc Andreessen, a Facebook director, tweeted that India had made another economically suicidal decision and, in a post he deleted within hours, suggested that anti-colonialism had cost Indians dearly for decades and asked why stop now. Facebook rejected the remarks, Mark Zuckerberg called them deeply upsetting, and on 11 February Facebook withdrew Free Basics from India.
It was a digital-rights milestone rather than a security story, and it held: TRAI's full net-neutrality recommendations followed in November 2017, and in July 2018 the Department of Telecommunications accepted them and wrote non-discrimination into operators' licences. The month's other Indian items were smaller. Quick Heal Technologies, the Pune anti-virus maker, listed on 18 February at Rs 321 a share after an issue subscribed nearly eleven times over, and spent its first week falling — a Digital Guard story for later. And the SmeshApp affair — a chat app on Google Play that an Indian television investigation said Pakistani handlers were using to track soldiers — is a March story: Google removed it on 15 March, and it waits for that edition.
Two miles an hour into a bus
On 14 February 2016 a Google Lexus, creeping at two miles an hour around sandbags on El Camino Real in Mountain View, struck the side of a bus doing fifteen. Nobody was hurt; the report the California DMV released on 29 February showed the test driver had assumed the bus would give way, and Google conceded that had its car not moved there would have been no collision — the first crash it accepted was partly its car's fault. The project became Waymo, which carries paying passengers with nobody at the wheel in several American cities. Microsoft confirmed on 3 February that it was buying SwiftKey, the London predictive-keyboard firm, for a reported $250 million. On 24 February DeepMind unveiled DeepMind Health and Streams, an app to flag acute kidney injury at London's Royal Free that contained no artificial intelligence. New Scientist revealed in April that it drew on 1.6 million patients' records; the Information Commissioner ruled in July 2017 that the hospital had breached the Data Protection Act, and in 2021 Google announced it was closing Streams.
Quick Heal's Rs 451 crore debut
Quick Heal, the Pune anti-virus maker, took bids from 8 to 10 February 2016 for a Rs 451 crore offer: Rs 250 crore of new shares, earmarked for advertising, research and offices in Kolkata, Pune and New Delhi, and the rest sold by the founding Katkar brothers and Sequoia Capital India. On 18 February the stock opened on the NSE at Rs 305, touched Rs 258 and closed at Rs 254, a fifth under the issue price; a decade later it trades at well under half of it. Elsewhere, Google's Tavis Ormandy spent early February on the security vendors. Malwarebytes fetched its updates over plain HTTP, unsigned, so anyone in the path could rewrite them; chief executive Marcin Kleczynski wrote on 1 February that server-side fixes were in, a client fix was three to four weeks away, and a bug bounty was opening. Comodo's Chromodo, the Chrome fork its Internet Security suite installed as default browser, had the same-origin policy switched off; Comodo blamed an ad-blocking add-on, shipped a hotfix Ormandy showed was trivially bypassed, then a build without it.
⏳ Time capsule — February 2016
- On 11 February, in Washington, the LIGO collaboration announced the first direct detection of gravitational waves — a signal recorded on 14 September 2015 from two black holes merging some 1.3 billion light-years away, a century after Einstein predicted the ripples; the 2017 Nobel prize in physics followed.
- An avalanche struck an Indian Army post on the Siachen glacier on 3 February, burying ten soldiers of the 19 Madras at about 19,600 feet; Lance Naik Hanumanthappa Koppad was found alive under the snow six days later, on 8 February, and died at the Army's Research and Referral hospital in Delhi on 11 February.
- Harper Lee, author of To Kill a Mockingbird, and Umberto Eco, author of The Name of the Rose, died on the same day, 19 February — she at 89 in Monroeville, Alabama, he at 84 in Milan.
- At the Oscars on 28 February Leonardo DiCaprio won Best Actor for The Revenant, his first win on his fifth acting nomination, and used the speech to talk about climate change; Spotlight took Best Picture.
The founding heist
Ten years on, the heist is the founding document of state cybercrime. Symantec tied the malware's code to the Lazarus group and the Sony attack on 26 May 2016; the FBI's complaint against Park Jin Hyok, unsealed on 6 September 2018, listed the heist alongside Sony and WannaCry, and a 2021 indictment added two more officers of North Korea's Reconnaissance General Bureau. None has been arrested. SWIFT launched a customer security programme that May as copycats surfaced in Vietnam and Ecuador — the story of the May edition. Bangladesh Bank sued RCBC in New York in January 2019; the case, moved to state court, was still alive after a February 2024 ruling dismissed some claims and let the rest proceed. Roughly $15 million of the $81 million ever came back.
Apple's fight ended in March without a ruling, and returned, unresolved, to the same February nine years later, when Apple withdrew its strongest encryption from Britain rather than build the door a secret order demanded. Hollywood Presbyterian's $17,000 became a footnote once WannaCry reached the NHS in May 2017. Linux Mint's poisoned download of 20 February previewed the supply-chain attacks June 2017 made infamous; the IRS's 26 February admission that 724,000 taxpayer accounts had been accessed, and Snapchat's disclosure two days later that a payroll employee had emailed colleagues' tax forms to an impostor posing as its chief executive, opened a decade of identity fraud. And the Lazarus group never stopped robbing banks; it changed banks — by February 2025 its haul from one exchange, Bybit, was $1.5 billion, nearly twenty times what it carried out of Dhaka.