Finastra, World’s Third Largest Fintech, Hit by Ransomware
.jpg)
London-based Finastra, the world’s third-largest financial services software provider, has been hacked. The fintech giant told customers that affected servers “both in the USA and elsewhere” had been disconnected from the internet while it contains the breach.
In a short statement, the company initially described noticing “potentially anomalous activity”, updating this late Friday to confirm a ransomware attack.
Finastra, formed through the merger of Misys and DH Corp. in June 2017, provides a wide range of software and services across the financial services ecosystem, ranging from retail and investment banking systems through to treasury, payments, cash management, trade, and supply chain finance, among other offerings.
It is owned by a private equity fund. Finastra’s 9,000 customers include 90 of the top 100 banks globally. It employs over 10,000 and has annual revenues of close to $2 billion.
Finastra Hacked: We Do Not Believe Clients’ Networks Were Impacted
Chief Operating Officer Tom Kilroy said: “Earlier today, our teams learned of potentially anomalous activity on our systems. Upon learning of the situation, we engaged an independent, leading forensic firm to investigate the scope of the incident. Out of an abundance of caution and to safeguard our systems, we immediately acted to voluntarily take a number of our servers offline while we continue to investigate.
He added: “At this time, we strongly believe that the incident was the result of a ransomware attack and do not have any evidence that customer or employee data was accessed or exfiltrated, nor do we believe our clients’ networks were impacted. ”
“We are working to resolve the issue as quickly and diligently as possible and to bring our systems back online, as appropriate. While we have an industry-standard security program in place, we are conducting a rigorous review of our systems to ensure that our customer and employee data continues to be safe and secure. We have also informed and are cooperating with the relevant authorities and we are in touch directly with any customers who may be impacted as a result of disrupted service.”
Finastra appears to have earlier been running an unpatched Pulse Secure VPN, which is vulnerable to CVE-2019-11510: a vulnerability in the VPN (previously known as Juniper SSL VPN) which in 2019 was found to have a number of severe security issues that could, when chained together, allow a hacker to write arbitrary files to the host.
(Needless to say, it is unclear at this juncture if that had remained unpatched and was the initial vector for this particular breach. Finastra hasn’t disclosed such details).
An email by Finastra to customers, as reported by Security Boulevard, reads: “Our approach has been to temporarily disconnect from the internet the affected servers, both in the USA and elsewhere, while we work closely with our cybersecurity experts to inspect and ensure the integrity of each server in turn.
In a late Sunday update, Finastra said it was “now able to bring back online the servers which we voluntarily took offline whilst we neutralized the threat.
COO Tom Kilroy added: “We are working with our impacted customers systematically and securely to return to normal operations. Because our solutions each have their own nuanced processes to move from being available to operationally live, each of our products will be back once readiness steps are completed… Thank you for your patience and understanding as we restore our systems. We will provide further information as soon as it is available.”
source cbronline
Industry: Cyber Security
Latest Jobs
-
- Security Analyst - Internal role. London commutable. Permanent
- London
- N/A
-
Security Analyst - Internal role. London commutable opportunity. Operational Security - Investigate, escalate and proactively work to ensure household name remains protected. Project Security - Coordinate, log change requests with project delivery teams to meet security requirements Policy / compliance - work with team to aid in uplifting these as and where needed This role is role to investigate, escalate and proactively work to protect a globally recognised brand. You must have current hands on operational analytical security experience with Microsoft technology stack Someone with a SOC Analyst / security engineering background would be well suited. This position will join a small team and would suit someone that has broad experience across the security threat landscape. Experience / knowledge across industry GRC standards such NIST, ISO27001 etc very advantageous and a priority. You will work across multiple teams proactively working to secure the business. Must be able to commute to Central London 3 days a week. Visa sponsorship not available Apply today to find out more.
-
- Network / Security Infrastructure Engineer | West London | Permanent
- London
- N/A
-
Network / Security Infrastructure Engineer | West London | Current Config, Install, upgrade experience On prem / Datacetner experience essential. Hands on experience MUST include: Routing, Switching, Network Security (firewall, IDS etc), Microsoft exchange / Exchange 365. Scripting / automation experience wanted. Python, Powershell etc Regular travel to West London is required. Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1
-
- SailPoint File Access Manager Consultant/ Architect
- N/A
- discussed on applications
-
SailPoint File Access Manager (SailPoint FAM) Consultant/ Architect is required for an up coming projects, Ideally looking for someone with experience in Designing and deploying SailPoint FAM , this is a new Deployment, you will work with customer in the initial workshop phase, to understand requirements and to get the initial design, you will then be responsible for deploying the solution. This is a home based role, with some onsite visits required during the length of the project. We are looking for someone who has previous experience in Deploying SailPoint FAM (ideally done design work) Need to have experience with SharePoint and ideally Azure and Share file
-
- DV Cleared CyberArk Consultant- Contract
- City of London
- Upto £700 per day
-
CyberArk Consultant is needed to be responsible for leading the deployment of CyberArk solutions for this Secure government site You will work with customer, helping to create CyberArk Strategic Roadmaps, on-boarding accounts, product and process integration into the CyberArk Solution and Proviso of Installation and technical Documentation. We are looking for this individual to have experience in: In CyberArk deployment, and ideally leady the deployment both strategically and also technically for this project we need the consultant to hold current DV cleared status For the right individual this could be a long term project.