Deutsche Bank AG has reportedly confirmed to BleepingComputer that a data breach at one of its service providers led to the exposure data of its customers'. The breach was likely part of an attack that exploited a vulnerability in its MOVEit Transfer platform.
“We have been notified of a security incident at one of our external service providers, which handles account switching in Germany,” a Deutsche Bank spokesperson told BleepingComputer.
The company said that the attack targeting its service provider is the same one that has targeted more than 100 companies in more than 40 countries. With this statement, it is apparently implying that the recent incident is related to the wave of MOVEit attacks by the Clop ransomware gang.
See also: MOVEit Transfer customers warned to patch new, critical flaw
The banking services company clarified that systems were not affected by the incident.
The German bank, which is one of the world's largest, said the incident affected customers in Germany who used the account switching service in 2016, 2017, 2018 and 2020.
Fortunately, according to the bank, only a limited amount of personal data has been exposed. Deutsche Bank has not disclosed the number of people affected, but said everyone has been informed about the immediate impact and the precautions they need to take.
The bank is currently investigating the causes of the data breach and is taking measures to improve security and the protection of customer data.
Deutsche Bank said that cybercriminals cannot gain access to user accounts using the exposed data. However, it is possible that they may try to make unauthorized charges. According to the letter sent to customers, the first name, last name and IBAN have been leaked.
See also: MOVEit attacks: Siemens Energy confirmed data breach
Other banks have also been affected by the provider's data breach
German media reports that the security incident at the service provider used by Deutsche Bank has also affected other major banks and financial service providers, including Commerzbank, Postbank, Comdirect and ING.
Handelsblatt statement from Commerzbank stating that the service provider that was breached is Luxembourg-based “Majorel.” The provider has already confirmed that it had been the target of a cyberattack.
Commerzbank told the German news agency that none of its customers were affected. However, its subsidiary, Comdirect , was indirectly affected. Postbank limited itself to confirming a limited impact from the incident. ING said it had been informed of a cyberattack on a service provider that affected some customers.
Cl0p and MOVEit attacks
The ransomware gang Cl0p claimed responsibility for exploiting a zero-day bug in the MOVEit platform on June 14.
The gang slowly began leaking the names of victims who did not want to negotiate, starting on June 15. As of July 10, Cl0p's website lists more than 120 alleged victims.
See also: Microsoft Patch Tuesday July 2023: Fixes 132 vulnerabilities
Security experts predict that there are over 230 victims of the breach MOVEit and possibly more, as the fallout from third-party software vendors affected by MOVEit attacks, such as Majorel, can affect any company using their services.
As for Deutsche Bank AG and other banks, things are quite serious. Customers should be very careful and take measures, such as monitoring their account activity, using strong passwords and immediately notifying the bank if suspicious activity is detected.
Source: www.bleepingcomputer.com
