Hacking group “FIN11” has posted on its data leak site files allegedly stolen from oil and gas giant “Shell,” likely during a security incident involving the Accellion FTA (File Transfer Appliance) file-sharing service. The leaked data includes data belonging to numerous universities.
Last week, Shell revealed that it was among the organizations affected by the cyberattack , confirming that the attackers were able to steal both corporate data and the personal details of its employees. Some of those files – including passport copies, an appraisal report and a document written in Hungarian – are now publicly available on a Tor-based site where hackers carrying out Clop ransomware attacks post stolen information.
Read also: Shell: Reports data breach related to Accellion hack
At the time of the attack on Accellion’s FTA, the service was used by approximately 300 customers, 25 of whom are believed to have suffered a significant data breach. Among the organizations affected are Qualys, Kroger, Jones Day, Bombardier, and the Washington State Auditor’s Office (SAO).
See also: Ziggy ransomware: Ransom payments are being returned to victims!
Data stolen from some of these organizations ended up on the FIN11 data leak site on the Tor network, along with files allegedly stolen from several educational institutions, including the University of Miami, Yeshiva University, the University of Maryland, the University of California, the University of Colorado, and Stanford University .
In a breach notification posted on March 26, the University of Miami confirmed the impact of the Accellion hack, claiming that the file sharing service “had been used by a small number of individuals at the University to transfer files too large for email” and that use of the service has been discontinued.
Proposal: DHS: SolarWinds hackers breached officials' email accounts
The FIN11 hackers also released patient data from the UHealth . The leaked information includes names, phone numbers, and email addresses, among other data. Specifically, the university states the following in its official statement about the breach:
“We understand that the Accellion security incident impacted multiple federal, state, local, tribal, and territorial government agencies, as well as private businesses, including those in the medical, legal, telecommunications, finance, higher education, retail, and energy sectors.
Information source: securityweek.com
