World’s Third Largest Fintech Hit by Ransomware

Table of Contents

[ad_1]

Add to favorites

“We are anticipating some disruption to certain services”

London-based Finastra, the world’s third largest financial services software provider, has been hacked. The fintech giant told customers that affected servers “both in the USA and elsewhere” had been disconnected from the internet while it contains the breach.

In a short statement, the company initially described noticing “potentially anomalous activity”, updating this late Friday to confirm a ransomware attack.

Finastra, formed through the merger of Misys and DH Corp. in June 2017, provides a wide range of software and services across the financial services ecosystem, ranging from retail and investment banking systems through to through to treasury, payments, cash management, trade and supply chain finance, among other offerings.

It is owned by a private equity fund. Finastra’s 9,000 customers include 90 of the top 100 banks globally. It employs over 10,000 and has annual revenues of close to $2 billion.

Finastra Hacked: We Do Not Believe Clients’ Networks Were Impacted

Chief Operating Officer Tom Kilroy said: “Earlier today, our teams learned of potentially anomalous activity on our systems. Upon learning of the situation, we engaged an independent, leading forensic firm to investigate the scope of the incident. Out of an abundance of caution and to safeguard our systems, we immediately acted to voluntarily take a number of our servers offline while we continue to investigate.

He added: “At this time, we strongly believe that the incident was the result of a ransomware attack and do not have any evidence that customer or employee data was accessed or exfiltrated, nor do we believe our clients’ networks were impacted. ”

“We are working to resolve the issue as quickly and diligently as possible and to bring our systems back online, as appropriate. While we have an industry-standard security program in place, we are conducting a rigorous review of our systems to ensure that our customer and employee data continues to be safe and secure. We have also informed and are cooperating with the relevant authorities and we are in touch directly with any customers who may be impacted as a result of disrupted service.”

Travelex deja vu? https://t.co/kWJwVgigcF pic.twitter.com/JrdDojlTuF

— Bad Packets Report (@bad_packets) March 20, 2020

Finastra appears to have earlier been running an unpatched Pulse Secure VPN, which is vulnerable to CVE-2019-11510: a vulnerability in the VPN (previously known as Juniper SSL VPN) which in 2019 was found to have a number of severe security issues that could, when chained together, allow a hacker to write arbitrary files to the host.

(Needless to say, it is unclear at this juncture if that had remained unpatched and was the initial vector for this particular breach. Finastra hasn’t disclosed such details).

An email by Finastra to customers, as reported by Security Boulevard, reads: “Our approach has been to temporarily disconnect from the internet the affected servers, both in the USA and elsewhere, while we work closely with our cybersecurity experts to inspect and ensure the integrity of each server in turn.

“Using this ‘isolation, investigation and containment’ approach will allow us to bring the servers back online as quickly as possible, with minimum disruption to service, however we are anticipating some disruption to certain services, particularly in North America, whilst we undertake this task. Our priority is ensuring the integrity of the servers before we bring them back online and protecting our customers and their data at this time.”

Is your company affected by this incident? Want to talk to us on or off the record? Email ed dot targett at cbronline dot com, or @targett on encrypted messenger Wire.