Accellion data breach: Difference between revisions
added intro, background, half of the attack, and started draft for list of responses, also added cargo. |
finished attack, added and made grammar corrections and errors, added images, started working on list of responses, along with other changes |
||
| Line 14: | Line 14: | ||
==The Attack== | ==The Attack== | ||
Around Mid December, FIN11 targeted Accellion 20 year | Around Mid December, FIN11 targeted Accellion 20 year legacy [[wikipedia:File_transfer|File Transfer Appliance]](FTA), deploying 2 [[wikipedia:Zero-day_vulnerability|zero-day-vulnerabilities]] that granted access to installation of a custom [[wikipedia:Web_shell|web shell]] named DEWMODE<ref>{{Cite web |date=23 February 2021 |title=Accellion Compromise Impacts Many Targets Including Healthcare Organizations |url=https://www.hhs.gov/sites/default/files/accellion-analyst-note.pdf |url-status=live |access-date=26 March 2026 |website=hhs.gov}}</ref>, allowing for SQL injection into Accellion systems. On 16 December, Accellion became aware of the vulnerability after a customer reported the vulnerability, and shorty after releasing a patch within 72 hours on 20 and 23 of December 2020.<ref name=":1">{{Cite web |last=Neill |first=Rob |date=3 March 2021 |title=Accellion hack: timeline clarifies when and how customers were notified |url=https://www.arnnet.com.au/article/1261917/accellion-hack-timeline-clarifies-when-and-how-customers-were-notified.html |url-status=live |access-date=26 March 2026 |website=ARN}}</ref> On 12 January, the company released a statement announcing the attack and urging customers to update to their newely released communication platform kiteworks.<ref>{{Cite web |date=12 January 2021 |title=Press Release Accellion Responds to Recent FTA Security Incident |url=https://www.kiteworks.com/company/press-releases/accellion-responds-to-recent-fta-security-incident/ |url-status=live |archive-url=https://web.archive.org/web/20260118203606/https://www.kiteworks.com/company/press-releases/accellion-responds-to-recent-fta-security-incident/ |archive-date=18 January 2026 |access-date=26 March 2026 |website=Kiteworks}}</ref> On 20 January, hackers conducted more attacks after finding new vulnerabilities that included 2 more [[wikipedia:Zero-day_vulnerability|zero-day-vulnerabilities]]<ref name=":2">{{Cite web |date=1 March 2021 |title=ACCELLION, INC. FILE TRANSFER APPLIANCE (FTA) SECURITY ASSESSMENT |url=https://kiteworks.com/sites/default/files/trust-center/accellion-fta-attack-mandiant-report-full.pdf |url-status=live |archive-url=https://web.archive.org/web/20211128204658/https://kiteworks.com/sites/default/files/trust-center/accellion-fta-attack-mandiant-report-full.pdf |archive-date=28 November 2021 |access-date=27 March 2026 |website=Kiteworks}}</ref>, however after the vulnerability were noticed by Accellion customer service on 22 January, they were shortly patched three days later.<ref name=":0" /><ref name=":1" />Around late January, victims started receiving ransom emails that threatens to publish the stolen data. If the victim didn't respond, they would receive several more warnings messages urging the victim to respond.<ref>{{Cite web |last=Ilascu |first=Ionut |date=22 February 2021 |title=Global Accellion data breaches linked to Clop ransomware gang |url=https://www.bleepingcomputer.com/news/security/global-accellion-data-breaches-linked-to-clop-ransomware-gang/ |url-status=live |access-date=27 March 2026 |website=BleepingComputer}}</ref> The company would implement another patch on 28 January that enhanced the security of the 23 December patch. On 01 February, Accellion released an statement detailing the attack and adding no new vulnerabilities were detect at the time.<ref>{{Cite web |date=1 February 2021 |title=Press Release Accellion Provides Update to Recent FTA Security Incident |url=https://www.accellion.com/company/press-releases/accellion-provides-update-to-recent-fta-security-incident/ |url-status=live |archive-url=https://web.archive.org/web/20210202020120/https://www.accellion.com/company/press-releases/accellion-provides-update-to-recent-fta-security-incident/ |archive-date=2 February 2021 |access-date=26 March 2026 |website=Accellion}}</ref> A last patch was implemented on 01 March in collaboration with [[wikipedia:Mandiant|Mandiant]] (subsidiary to [[Google]]) that fixed two additional vulnerabilities.<ref name=":2" /> Accellion would announce termination of its 20 year legacy [[wikipedia:File_transfer|File Transfer Appliance]], giving customers till 30 April to make any changes to their licensing agreements.<ref>{{Cite web |date=27 March 2026 |title=Accellion |url=https://kiteworks.com/sites/default/files/resources/fta-eol.pdf |url-status=live |archive-url=https://web.archive.org/web/20220125042927/https://kiteworks.com/sites/default/files/resources/fta-eol.pdf |archive-date=25 January 2022 |access-date=27 March 2026 |website=Kiteworks}}</ref>[[File:Hacker group ransom demand message.png|alt=Hackers Ransom Demand Message|thumb|Hackers Ransom Demand Message ]] | ||
[[File:Hacker group last warning message.png|thumb|Hacker group last warning message]] | |||
==List of responses== | ==List of responses from affected organizations== | ||
After being informed of the attack, several companies decided to terminate their agreements with Accellion and reach out to potentially affected customers. | After being informed of the attack, several companies decided to terminate their agreements with Accellion and reach out to potentially affected customers. | ||
| Line 23: | Line 23: | ||
===Singtel=== | ===Singtel=== | ||
In 11 February 2021, Singtel released a statement announcing a investigation in collaborations with security experts and Cyber Security Agency of Singapore and made plans to cease operation of Accellion systems.<ref>{{Cite web |date=11 February 2021 |title=Media Statement relating to Accellion’s FTA Security Incident |url=https://www.singtel.com/about-us/media-centre/news-releases/media-statement-relating-to-accellion-fta-security-incident |url-status=live |access-date=27 March 2026 |website=Singtel}}</ref> On 17 February, Singtel released another statement detailing the results of their investigation, concluding that around 129,000 customers name, date of birth, mobile number, and home address was leaked, along with employees and staff financial information. The company highlighted plans to contact affected customers, and issuing an apology.<ref>{{Cite web |date=17 February 2021 |title=Singtel addresses data breach, moves to support affected stakeholders |url=https://www.singtel.com/about-us/media-centre/news-releases/singtel-addresses-data-breach-moves-to-support-affected-stakeholders |url-status=live |archive-url=https://web.archive.org/web/20260116181632mp_/https://www.singtel.com/about-us/media-centre/news-releases/singtel-addresses-data-breach-moves-to-support-affected-stakeholders |archive-date=16 January 2026 |access-date=26 March 2026 |website=Singtel}}</ref> <blockquote>''"While this data theft was committed by unknown parties, I’m very sorry this has happened to our customers and apologise unreservedly to everyone impacted. Data privacy is paramount, we have disappointed our stakeholders and not met the standards we have set for ourselves"''</blockquote> | |||
===Kroger=== | ===Kroger=== | ||
| Line 35: | Line 36: | ||
===Trillium=== | ===Trillium=== | ||
=== Kitework [removed later] === | |||
https://www.kiteworks.com/company/security-updates/mandiant-issues-final-report-regarding-accellion-fta-attack/ | |||
https://kiteworks.com/sites/default/files/trust-center/accellion-fta-attack-mandiant-report-full.pdf | |||
===Shell=== | ===Shell=== | ||
| Line 40: | Line 46: | ||
===https://web.archive.org/web/20210330165405/https://sao.wa.gov/breach2021/<nowiki/>=== | ===https://web.archive.org/web/20210330165405/https://sao.wa.gov/breach2021/<nowiki/>=== | ||
=== University of Colorado === | ===University of Colorado=== | ||
https://www.techtarget.com/searchsecurity/news/252502430/Accellion-breach-raises-notification-concerns | https://www.techtarget.com/searchsecurity/news/252502430/Accellion-breach-raises-notification-concerns | ||
=== Morgan Stanley === | ===Morgan Stanley=== | ||
https://techcrunch.com/2021/07/08/the-accellion-data-breach-continues-to-get-messier/ | https://techcrunch.com/2021/07/08/the-accellion-data-breach-continues-to-get-messier/ | ||
==Lawsuit== | ==Lawsuit== | ||
{{Ph-I-L}}<ref>{{Cite web |last=Coble |first=Sarah |date=17 January 2022 |title=Accellion Reaches $8.1m Data Breach Settlement |url=https://www.infosecurity-magazine.com/news/accellion-reaches-81m-data-breach/ |url-status=live |access-date=26 March 2026 |website=Infosecurity Magazine}}</ref> https://www.scworld.com/analysis/accellion-reaches-8-1m-settlement-in-data-breach-lawsuit | {{Ph-I-L}}<ref>{{Cite web |last=Coble |first=Sarah |date=17 January 2022 |title=Accellion Reaches $8.1m Data Breach Settlement |url=https://www.infosecurity-magazine.com/news/accellion-reaches-81m-data-breach/ |url-status=live |access-date=26 March 2026 |website=Infosecurity Magazine}}</ref> https://www.scworld.com/analysis/accellion-reaches-8-1m-settlement-in-data-breach-lawsuit | ||
https://www.classaction.org/news/accellion-facing-class-action-over-dec.-2020-file-transfer-service-data-breach | |||
==Consumer response== | ==Consumer response== | ||