NTMA yet to recover €2.5m stolen in phishing attack - RTE.ie

Updated / Thursday, 14 May 2026 18:48 The NTMA is responsible for managing public assets and liabilities for long-term benefit on behalf of the State Róisín Cullen By Róisín Cullen The National Treasury Management Agency has said it is unable to recover the rest of the €5 million stolen during a phishing attack last summer. The NTMA is responsible for managing public assets and liabilities for long-term benefit on behalf of the State. The agency oversees the Ireland Strategic Investment Fund, which invests in projects that support economic activity and employment in Ireland. NTMA Chief Executive Frank O'Connor told the Public Accounts Committee that €2.5m of the stolen €5m has been recovered so far. In July 2025, the agency received a fraudulent payment request from a third party that was designed and timed to pass as a legitimate request from an investee of the fund. TDs heard that six people authorised the electronic payment at various stages, and the NTMA could not rule out the involvement of state actors. Mr O'Connor said recovering the remaining half of the stolen €5m will "get trickier" as time passes, stressing he did not want to "set expectations too high". "We continue to chase," he said, adding "We are not giving up on it". Responding to a question from Fine Gael TD Joe Neville, the NTMA's Chief Financial and Operating Officer Ian Black said six people authorised the electronic payment in July 2025 at different stages. "People checked it but again it wasn't effective," he said. NTMA CEO Frank O'Connor will tell the PAC that the national debt now stands at €200 billion "They didn't check properly," responded Mr Neville. Mr O’Connor said "it’s honestly very hard to know" when the chairman of the committee John Brady TD asked if state actors were involved. The CEO said: "This is becoming quite common all over the world. "Money got moved internationally quite quickly. "We saw where some money went and we managed to get some of it back," said Mr O’Connor. He added that the investee had a breach of their email systems. "They were compromised. "That allowed a threat actor to be in that email for a period of time and then send from a valid email to us - a valid instruction for capital," he said. Mr O'Connor said the people involved in the payment process discovered the next day "in conversation" that "the capital hadn't gone to the investee company". "The minute they saw that they told us," he told the committee. The NTMA’s Chief Executive also said some years they "do more than half a trillion in payments", adding "we are a target". He said the controls in place at the time "didn't stand up to the threat actors who managed to gather non-public information quite a bit". Fianna Fáil TD Albert Dolan said the phishing attack was a "really scary incident", adding the NTMA are dealing in "much bigger sums". "What would happen if something bigger was to go wrong here?" he asked. Mr Dolan asked if the investee had received money from the NTMA previously to which Mr O'Connor responded: "The year before." "You had the bank details. So how did that not get picked up?" asked Mr Dolan. Mr O'Connor said this was because the request came from a legitimate email. The committee heard that Deloitte conducted an independent forensic investigation to "establish the facts and to examine relevant internal controls". This investigation is now completed and the NTMA said it has engaged with the Comptroller and the Auditor General on the issue. Mr O'Connor said enhanced controls were put in place immediately after the incident to protect it against future financial crime risks. "Deloitte's investigation also recommended certain key measures to increase protection against similar financial crime risks, which we have implemented in full," he said. The NTMA is continuing its efforts to recover the rest of the stolen money, Mr O'Connor said. Ireland's national debt could reach €250bn by the 2030s The committee also heard Ireland's national debt now stands at €200 billion and could reach €250bn by the 2030s. Mr O'Connor told the committee that this would be "very high-level indebtedness" that "carries risk". Mr O'Connor said the agency managed a national debt of around €30 billion at its inception 35 years ago, and "that was seen as high then". The NTMA is responsible for managing public assets and liabilities for long-term benefit on behalf of the State. He said it is something that debt managers cannot be complacent about and "the ability to service that debt is critical". "Record low interest rates that arose from Quantitative Easing" in recent years made servicing debt "easier and cheaper," Mr O'Connor said. TDs heard that in 2024 the cost of the NTMA servicing debt was €3.2 billion, 60% below its peak of €8 billion in 2013. Mr O'Connor said the NTMA "took advantage of the low-interest rate era by locking in low borrowing costs for long terms". The agency also borrowed money early at low rates, he said, before warning "that era is now over". "The benefits of borrowing at low fixed rates will recede, as these lower-cost debts gradually mature and are replaced with more expensive debt. "We also have to be prepared for rates potentially rising further and the additional costs that would come with that," Mr O'Connor said. More stories on News Business Insta Ireland National Treasury Management Agency Politics