Extortion group threatens to leak bank vendor's secrets

• Key insight: The extortion group n0n says it will publish Finzly's "access secrets for payment infrastructure" and cloud access keys if no settlement is reached.
• What's at stake: Finzly's website lists 11 banks and credit unions as clients, including Synovus, First Citizens and First Horizon, and its platform links them to ACH, Fedwire, RTP, FedNow and Swift.

Overview bullets generated by AI with editorial review.

Processing Content

A cyber extortion group claimed it stole access keys and other secrets for the payment and cloud systems of Finzly, a technology vendor that serves banks and credit unions, and it is threatening to publish them Friday night.

The group, which calls itself n0n, added Finzly to its leak site over the weekend, according to ransomware.live, which tracks the leak sites of ransomware and extortion groups.

Finzly "recently learned that a cyber extortion group has named Finzly in an online claim" and is "actively investigating the claim with external cybersecurity experts," a Finzly spokesperson told American Banker. The company is "fully operational," the spokesperson said.

The spokesperson did not say whether anyone took credentials from Finzly, whether the company received a ransom demand, whether it has notified clients nor whether it has changed any digital keys to its systems.

N0n had not posted any sample of the data on its leak site as of Tuesday afternoon, which leaves uncertainty about how credible the criminal group's claims are.

N0n has "credible access to at least some listed victims," according to a report from the threat-intelligence firm Cyfirma. The firm rated its confidence in that finding as "moderate."

Unless Finzly pays what n0n's listing calls a "settlement," the extortion group will publish "network configuration and access secrets for payment infrastructure" and "cloud environment topology and access keys" at 8:20 p.m. Eastern time on Friday, according to the listing.

(Access keys and secrets are the credentials software uses to log in to other systems. A cloud environment's topology is a map of how its systems connect.)

Finzly, which is based in Charlotte, North Carolina, sells a platform called BankOS that links banks to payment networks including ACH, Fedwire, RTP, FedNow and Swift through a single connection.

Finzly's website lists 11 banks and credit unions among its clients: Synovus, First Citizens Bank, First Horizon, EverBank, Columbia Bank, Customers Bank, Live Oak Bank, 1st Source Bank, Metropolitan Commercial Bank, United Community Bank and Wings Credit Union.

None of the 11 institutions immediately answered questions about the claimed data breach.

The n0n listing does not say whether the keys, if genuine, would reach clients' payment traffic or customer data. However, a single vendor's breach can reach many banks at once.

For example, when the extortion group ShinyHunters stole data from the bank technology vendor Jack Henry this year, it exposed information belonging to account holders at several client institutions, according to the company.

N0n launched its leak site on Sept. 18 and has since posted 131 listings of organizations in 32 countries, according to ransomware.live.

The group most likely breaks in using passwords stolen by infostealer malware (programs that harvest logins from infected computers), according to Cyfirma's report.

Organizations that use systems from a company n0n has listed should replace the credentials their software and file-transfer tools use to connect with that company, according to Cyfirma.

They should also require multifactor authentication (a second login step beyond a password) on remote-access tools, according to the report.