Accellion data breach

Around Mid December in 2020, several hacker group going by the names FIN11, UNC2546, and CLOP, infiltrated Accellion systems using SQL injection, affecting organizations delving to various aspects of education, medicine, and finance, leaking over 9 million customers and employees personal information.^[1] This later turn into a lawsuit that reached a $8.1 million settlement on 20 January 2022.

A financially motivated hacker group going by FIN11 has conducted malware and ransomware attacks against financial, retail, and medical related organizations since 2016.^[2] It shares close ties to CLOP, a hacker group that since 2016 has ran phishing campaigns and malware distributions^[3], and UNC2546, an unknown hacker group that been shown to conduct malware attacks and SQL injection.^[4][5]

Founded in 1999, Accellion is a file sharing service provider that later rebranded into Kiteworks.

Around Mid December, FIN11 targeted Accellion 20 year legacy File Transfer Appliance (FTA), deploying two zero-day-vulnerabilities that granted access to installation of a custom web shell named DEWMODE^[6], allowing for SQL injection into Accellion systems. On 16 December, Accellion became aware of the vulnerability after a customer reported the vulnerability, and shorty after releasing a patch within 72 hours on 20 and 23 of December 2020.^[7] On 12 January, the company released a statement announcing the attack and urging customers to update to their newely released communication platform kiteworks.^[8] On 20 January, hackers conducted more attacks after finding new vulnerabilities that included 2 more zero-day-vulnerabilities^[9], however after the vulnerability were noticed by Accellion customer service on 22 January, they were shortly patched three days later.^[1][7]Around late January, victims started receiving ransom emails that threatens to publish the stolen data. If the victim didn't respond, they would receive several more warnings messages urging the victim to respond.^[10] The company would implement another patch on 28 January that enhanced the security of the 23 December patch. On 01 February, Accellion released an statement detailing the attack and adding no new vulnerabilities were detect at the time.^[11] A last patch was implemented on 01 March in collaboration with Mandiant (subsidiary to Google) that fixed two additional vulnerabilities.^[9] Accellion would announce termination of its 20 year legacy File Transfer Appliance, giving customers till 30 April to make any changes to their licensing agreements.^[12]

Companies began being informed of the breach around January through March, later releasing statments about the incident. Several companies decided to terminate their agreements with Accellion and collaborate with law enforcement and other companies, while also reach out to potentially affected customers.^[13][14]

In 11 February 2021, Singtel released a statement announcing a investigation in collaborations with security experts and Cyber Security Agency of Singapore and made plans to cease operation of Accellion systems.^[15] On 17 February, Singtel released another statement detailing the results of their investigation, concluding that around 129,000 customers name, date of birth, mobile number, and home address was leaked, along with employees and staff financial information. The company highlighted plans to contact affected customers, and issuing an apology.^[16]

"While this data theft was committed by unknown parties, I’m very sorry this has happened to our customers and apologise unreservedly to everyone impacted. Data privacy is paramount, we have disappointed our stakeholders and not met the standards we have set for ourselves"

On 23 January, Kroger was notified of the vulnerability after being informed by Accellion, resulting in the company conducting an investigation. Around February, Kroger issued a statement that sought discontinuation of Accellion systems as well as mention 1% of customers had pharmacy records, money services being affected in the attack. Additionally, it highlighted plans to inform affected consumers.^[17]

Starting on 03 March till 02 April, Qualys made a series of statement and updates after being alerted about the attack around December 2020. In collaboration with Accellion, FireEye, and Mandiant, a investigation pursued that found and contacted customers with leaked online and real life names, email addresses, job titles, and office addresses. Additionally, it found no impact or effect on its systems.^[18]

On 22 January, the city was first alerted of the incident by unknown sources, however the city issued a response on April 2021.^[19] When asked, a spokesperson responded by claiming "“It takes time to reach any sort of conclusion in view of the legacy system that was breached and the extent of investigation required." it was reported that around 35,000 citizens information was affected in the attack, however the city didn't receive a ransom email, leading to some speculation in the community of the meaning of the silence.^[20][21]

On 02 May, CXS made a statement highlighting the incident only leaking current and past employees personal information. The company didn't provide much details surrounding the incident in regards to customers or specific type of information, only saying “To date, this incident has had no impact on business operations or our ability to serve our customers".^[22][23]

The Company became aware of the attack on 25 January, and a month later released a statement, declaring customers address, date of birth, insurance ID number, and health information has been leaked and posted online. As compensation, the company gave 1 year credit monitoring and identity theft protection services to affected customers on 26 February.^[24] The company discussed plans to move and remove all data from Accellion systems, review files and sharing data practices.^[25]

Morgan Stanley third party vendor Guidehouse, a company that delivers account maintenance services, notified Morgan Stanely of the breach on 20 May 2021 after discovering the breach in March and finding information containing names, addresses, date of birth and social security numbers about Morgan Stanley clients in March.^[26][27][28] Morgan Stanley sent emails to affected victims on 08 June and later on 02 July, sending a email to the attorney general office located in concord informing them of the attack.^[29]

On 24 March, Healthnet, an American health care insurance provider, released a statement that declared customers addresses, date of birth, insurance ID number, and health information such as medical conditions and treatment information, was compromised. The company stated it started collaraborationg with law enforcement and cease operation of Accellion services.^[30]

https://web.archive.org/web/20210111063645/https://www.rbnz.govt.nz/news/2021/01/reserve-bank-response-to-illegal-breach-of-data-system

https://web.archive.org/web/20210115022125/https://www.rbnz.govt.nz/our-response-to-data-breach'

https://www.interest.co.nz/banking/109058/reserve-banks-says-it-working-directly-stakeholders-determine-how-many-people-have

https://www.bankinfosecurity.com/reserve-bank-new-zealand-investigates-data-breach-a-15737

Around March, Flagstar bank posted a post on its website alerting users that its been apart in a cybersecurity attack relating to one of their vendors Accellion. The company declared discontinuation of Accellion services and creating a calling center for affected individuals.^[31]

On 05 April, Trinity Health would declare customers personal and medical information was access and leaked online. The company announced plans to inform affected customers and create a headline to affected customers.^[32]

Trinity Health determined file(s) were present on the appliance at the time of this event. The files contained certain protected health information, including a combination of demographic, clinical and financial information such as your name, address, email, date of birth, healthcare provider, dates and types of health care services, medical record number, immunization type, lab results, medications, payment, payer name, and claims information. The confidential information of a very small number of impacted individuals included a social security number or credit card number.

California Health & Wellness became aware of the attack after being alerted from Accellion on 25 January, which upon notice immediately conducted an investigation alongside Accellion.^[33] In a statement released on ---, California Health & Wellness confirmed customers address, date of birth, insurance ID number, and related health information was compromised. The company announced plan to cease operation of Accellion software and gave affected customers 1 year identity protection service with IDX membership.

Arizona Complete Health released a statement on 26 February, confirming around 27,000 customers addresses, date of birth, insurance ID numbers, and medical conditions, were compromised after being informed of the attack on 25 January, The company announced it would cease operation of Accellion systems, removing all related data associated, and provide affected customers 1 year of credit monitoring services.^[34][35]

The company provided little information regarding the attack, with only responding in a statement made to the Wall Street Journal that it was affected by the attack. Allegedly, there was plan to arrange an agreement between CLOP, however the company went silent, resulting in releasing information about Jones Day clients. The hacker organization CLOP responded to the company's silence;^[36][37][38]

" we hacked their server where the Accellion was and took the data from there, we spammed all over the company and all over the contact sheet they repeatedly entered the chat and were silent"

The company sent an email to affected customers on 24 March after being informed by Accellion on 25 January. It lists customers Addresses, date of birth, insurance ID Number, and health information were compromised. The company announced discontinuation of Accellion services and gave affected customers 1 year IDX membership.^[39]

On 18 February 2021, a lawsuit was filed against Accellion for failure to secure personal information of its customers, alleging it resulting in the plaintiffs facing years of "constant surveillance of their financial and personal records, monitoring, and loss of rights".^[40][41] The case reached a $8.1 million settlement on 20 January 2022, requiring Accellion give 2 years of credit monitoring and insurance services and reimburse up to $10,000 or receive payment of $15 or $50 to affected individuals.^[42][43]