November 19, 2024

The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world’s top 50 banks, notified customers of the security incident after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company.

London-based Finastra has offices in 42 countries and reported $1.9 billion in revenues last year. The company employs more than 7,000 people and serves approximately 8,100 financial institutions around the world. A major part of Finastra’s day-to-day business involves processing huge volumes of digital files containing instructions for wire and bank transfers on behalf of its clients.

On November 8, 2024, Finastra notified financial institution customers that on Nov. 7 its security team detected suspicious activity on Finastra’s internally hosted file transfer platform. Finastra also told customers that someone had begun selling large volumes of files allegedly stolen from its systems.

“On November 8, a threat actor communicated on the dark web claiming to have data exfiltrated from this platform,” reads Finastra’s disclosure, a copy of which was shared by a source at one of the customer firms.

“There is no direct impact on customer operations, our customers’ systems, or Finastra’s ability to serve our customers currently,” the notice continued. “We have implemented an alternative secure file sharing platform to ensure continuity, and investigations are ongoing.”

But its notice to customers does indicate the intruder managed to extract or “exfiltrate” an unspecified volume of customer data.

“The threat actor did not deploy malware or tamper with any customer files within the environment,” the notice reads. “Furthermore, no files other than the exfiltrated files were viewed or accessed. We remain focused on determining the scope and nature of the data contained within the exfiltrated files.”

In a written statement in response to questions about the incident, Finastra said it has been “actively and transparently responding to our customers’ questions and keeping them informed about what we do and do not yet know about the data that was posted.” The company also shared an updated communication to its clients, which said while it was still investigating the root cause, “initial evidence points to credentials that were compromised.”

“Additionally, we have been sharing Indicators of Compromise (IOCs) and our CISO has been speaking directly with our customers’ security teams to provide updates on the investigation and our eDiscovery process,” the statement continues. Here is the rest of what they shared:

“In terms of eDiscovery, we are analyzing the data to determine what specific customers were affected, while simultaneously assessing and communicating which of our products are not dependent on the specific version of the SFTP platform that was compromised. The impacted SFTP platform is not used by all customers and is not the default platform used by Finastra or its customers to exchange data files associated with a broad suite of our products, so we are working as quickly as possible to rule out affected customers. However, as you can imagine, this is a time-intensive process because we have many large customers that leverage different Finastra products in different parts of their business. We are prioritizing accuracy and transparency in our communications.

Importantly, for any customers who are deemed to be affected, we will be reaching out and working with them directly.”

On Nov. 8, a cybercriminal using the nickname “abyss0” posted on the English-language cybercrime community BreachForums that they’d stolen files belonging to some of Finastra’s largest banking clients. The data auction did not specify a starting or “buy it now” price, but said interested buyers should reach out to them on Telegram.

abyss0’s Nov. 7 sales thread on BreachForums included many screenshots showing the file directory listings for various Finastra customers. Image: Ke-la.com.

According to screenshots collected by the cyber intelligence platform Ke-la.com, abyss0 first attempted to sell the data allegedly stolen from Finastra on October 31, but that earlier sales thread did not name the victim company. However, it did reference many of the same banks called out as Finastra customers in the Nov. 8 post on BreachForums.

The original October 31 post from abyss0, where they advertise the sale of data from several large banks that are customers of a large financial software company. Image: Ke-la.com.

The October sales thread also included a starting price: $20,000. By Nov. 3, that price had been reduced to $10,000. A review of abyss0’s posts to BreachForums reveals this user has offered to sell databases stolen in several dozen other breaches advertised over the past six months.

The apparent timeline of this breach suggests abyss0 gained access to Finastra’s file sharing system at least a week before the company says it first detected suspicious activity, and that the Nov. 7 activity cited by Finastra may have been the intruder returning to exfiltrate more data.

Maybe abyss0 found a buyer who paid for their early retirement. We may never know, because this person has effectively vanished. The Telegram account that abyss0 listed in their sales thread appears to have been suspended or deleted. Likewise, abyss0’s account on BreachForums no longer exists, and all of their sales threads have since disappeared.

It seems improbable that both Telegram and BreachForums would have given this user the boot at the same time. The simplest explanation is that something spooked abyss0 enough for them to abandon a number of pending sales opportunities, in addition to a well-manicured cybercrime persona.

In March 2020, Finastra suffered a ransomware attack that sidelined a number of the company’s core businesses for days. According to reporting from Bloomberg, Finastra was able to recover from that incident without paying a ransom.

This is a developing story. Updates will be noted with timestamps. If you have any additional information about this incident, please reach out to krebsonsecurity @ gmail.com or at protonmail.com.


15 thoughts on “Fintech Giant Finastra Investigating Data Breach

  1. Poster

    Hey Krebs, you can browse BreachForums without an account if you use the TOR hidden service mirror.

    Reply
  2. Worried

    As a Finastra customer, this is the first im hearing & have received no notification, but also doesnt sound surprising as recently they have processed allot of “emergency” changes and password resets.

    Looking through a comms trial of notifications, I believe Finastra knew about this allot earlier than maybe suggested, as we experienced allot of strange outages & access issues/changes prior to the 7th.

    Reply
    1. Francois

      This topic has been hot on FSISAC for a couple of weeks. Highly recommend joining

      Reply
  3. JustMyOpinion

    400GB worth of data stolen. For comparison, when I downloaded the entire English language wikipedia last year, it was a tad under 100GB.

    Reply
    1. FoodForThought

      Would be interesting to know what data was transferred over these SFTP services. Sounds like Business to Business (b2b) data used for automation.

      What are the chances the data is worthless, and it is a smoke screen to cover the fact they have modified a bunch of what I imagine is B2B csv data?

      Could any of these files be transactional files where the miscreant can insert their information which then results in money being transferred to them due to bank staff blindly trusting the information their system has ingested?

      Reply
      1. Tristan

        The threat actors will try to overplay it and the company will try to downplay it. For all we know it could be daily copies of 100mb xlsx spreadsheets going back 10 years growing each day generated by a nightly cronjob.

        But fortunately for these companies, these threat actors are more the smash-and-grab kind and not “slipstream a row of data into a spreadsheet during a holiday” kind. Persistence and long-term moves like what you described, or something akin to the Bangladesh bank breach, are not their primary focus, since it requires a lot of time and manpower to study how everything operates, as well as a massive network of launderers and real bank accounts connected to real identities.

        Reply
    2. Fr00tL00ps

      Yes, that may sound like a lot of data to the average home user, but depending on the level of compromise achieved, the threat actors may have had access to Finastra’s backend transport service. IBM Aspera can support speeds of up to 10 Gps.

      https://www.ibm.com/aspera/file-transfer-calculator/

      Even at 1 Gps, moving that amount of data from the US to Europe could take less than an hour.

      Reply
  4. Musa Muhammad Auwal

    I am from Nigeria and it is my dream to learn cybersecurity. But unfortunately in my Country, the course is for wealthy people (It’s not available in our local universities).
    But now that I have a Laptop, I enrolled in a Cybersecurity course on Coursera Yesterday with financial aid. Today, I came across this platform while researching cybersecurity and ethical Hacking on GPT.

    Reply
    1. mealy

      The internet is full of courses. If a degree is what you seek, that is different than an education.

      Reply
    2. Mahhn

      Read everything Brian has written, look up everything you don’t understand. Learn the basics of TCP, DLLs, Registry, injections. Watch every DEFCON video you can, and branch out as you find things of interest. Welcome to the digital warzone.

      Reply
  5. Breach the Lord

    It’s so cute how they mention eDiscovery as a response to a breach. Total disconnect with incident response practices.

    Reply
  6. immajusssayin

    I wonder if “internal secure file transfer platform” = unpatched MoveIT instance….

    Reply
    1. Mike

      MoveIT or Accellion (aka Kiteworks) have both been plagued by 0-days over the past few years. Why? It isn’t because they are worse than other software product categories. It is because threat actors figured out the category is a valuable source of sensitive data. Whenever any application is relentlessly scanned, fuzzed, attacked, and users social engineered the app fails.

      Reply
      1. Mahhn

        “Why?” Because they made the horrid mistake of putting the management interface on the outside unrestricted.
        If it was a bathroom door in your house that has the twist lock on one side – they messed up and put it on BOTH sides, so anyone could unlock it and change settings. All it took was one person to notice the mistake. MoveIT was very lucky it wasn’t being abused from day 1 of its release. This is sadly to common an issue.

        Reply

Leave a Reply

Your email address will not be published. Required fields are marked *