The financial technology firm Finastra<\/strong> is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world\u2019s top 50 banks, notified customers of the security incident after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company.<\/p>\n London-based Finastra has offices in 42 countries and reported $1.9 billion in revenues last year. The company employs more than 7,000 people and serves approximately 8,100 financial institutions around the world. A major part of Finastra\u2019s day-to-day business involves processing huge volumes of digital files containing instructions for wire and bank transfers on behalf of its clients.<\/p>\n On November 8, 2024, Finastra notified financial institution customers that on Nov. 7 its security team detected suspicious activity on Finastra\u2019s internally hosted file transfer platform. Finastra also told customers that someone had begun selling large volumes of files allegedly stolen from its systems.<\/p>\n \u201cOn November 8, a threat actor communicated on the dark web claiming to have data exfiltrated from this platform,\u201d reads Finastra\u2019s disclosure<\/a>, a copy of which was shared by a source at one of the customer firms.<\/p>\n \u201cThere is no direct impact on customer operations, our customers\u2019 systems, or Finastra\u2019s ability to serve our customers currently,\u201d the notice continued. \u201cWe have implemented an alternative secure file sharing platform to ensure continuity, and investigations are ongoing.\u201d<\/p>\n But its notice to customers does indicate the intruder managed to extract or \u201cexfiltrate\u201d an unspecified volume of customer data.<\/p>\n \u201cThe threat actor did not deploy malware or tamper with any customer files within the environment,\u201d the notice reads. \u201cFurthermore, no files other than the exfiltrated files were viewed or accessed. We remain focused on determining the scope and nature of the data contained within the exfiltrated files.\u201d<\/span><\/p>\n In a written statement in response to questions about the incident, Finastra said it has been \u201cactively and transparently responding to our customers\u2019 questions and keeping them informed about what we do and do not yet know about the data that was posted.\u201d The company also shared an updated communication to its clients, which said while it was still investigating the root cause, \u201cinitial evidence points to credentials that were compromised.\u201d<\/p>\n \u201cAdditionally, we have been sharing Indicators of Compromise (IOCs) and our CISO has been speaking directly with our customers\u2019 security teams to provide updates on the investigation and our eDiscovery process,\u201d the statement continues. Here is the rest of what they shared:<\/p>\n \u201cIn terms of eDiscovery, we are analyzing the data to determine what specific customers were affected, while simultaneously assessing and communicating which of our products are not dependent on the specific version of the SFTP platform that was compromised. The impacted SFTP platform is not used by all customers and is not the default platform used by Finastra or its customers to exchange data files associated with a broad suite of our products, so we are working as quickly as possible to rule out affected customers. However, as you can imagine, this is a time-intensive process because we have many large customers that leverage different Finastra products in different parts of their business. We are prioritizing accuracy and transparency in our communications.<\/p>\n Importantly, for any customers who are deemed to be affected, we will be reaching out and working with them directly.\u201d<\/p>\n<\/blockquote>\n On Nov. 8, a cybercriminal using the nickname \u201cabyss0<\/strong>\u201d posted on the English-language cybercrime community BreachForums<\/strong> that they\u2019d stolen files belonging to some of Finastra\u2019s largest banking clients. The data auction did not specify a starting or \u201cbuy it now\u201d price, but said interested buyers should reach out to them on Telegram.<\/p>\n abyss0\u2019s Nov. 7 sales thread on BreachForums included many screenshots showing the file directory listings for various Finastra customers. Image: Ke-la.com.<\/p>\n<\/div>\n According to screenshots collected by the cyber intelligence platform Ke-la.com<\/a>, abyss0 first attempted to sell the data allegedly stolen from Finastra on October 31, but that earlier sales thread did not name the victim company. However, it did reference many of the same banks called out as Finastra customers in the Nov. 8 post on BreachForums.<\/p>\n The original October 31 post from abyss0, where they advertise the sale of data from several large banks that are customers of a large financial software company. Image: Ke-la.com.<\/p>\n<\/div>\n The October sales thread also included a starting price: $20,000. By Nov. 3, that price had been reduced to $10,000. A review of abyss0\u2019s posts to BreachForums reveals this user has offered to sell databases stolen in several dozen other breaches advertised over the past six months.<\/p>\n The apparent timeline of this breach suggests abyss0 gained access to Finastra\u2019s file sharing system at least a week before the company says it first detected suspicious activity, and that the Nov. 7 activity cited by Finastra may have been the intruder returning to exfiltrate more data.<\/p>\n Maybe abyss0 found a buyer who paid for their early retirement. We may never know, because this person has effectively vanished. The Telegram account that abyss0 listed in their sales thread appears to have been suspended or deleted. Likewise, abyss0\u2019s account on BreachForums no longer exists, and all of their sales threads have since disappeared.<\/p>\n It seems improbable that both Telegram and BreachForums would have given this user the boot at the same time. The simplest explanation is that something spooked abyss0 enough for them to abandon a number of pending sales opportunities, in addition to a well-manicured cybercrime persona.<\/p>\n In March 2020, Finastra suffered a ransomware attack<\/a> that sidelined a number of the company\u2019s core businesses for days. According to reporting from Bloomberg<\/a>, Finastra was able to recover from that incident without paying a ransom.<\/p>\n This is a developing story. Updates will be noted with timestamps. If you have any additional information about this incident, please reach out to krebsonsecurity @ gmail.com or at protonmail.com.<\/em><\/p>\n<\/div>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2020\/03\/finastra.png?resize=747%2C453&ssl=1\")
<\/p>\n\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2024\/11\/finastra-notice.png\")
<\/a><\/p>\n<\/a><\/p>\n