www.bleepingcomputer.com
Open in
urlscan Pro
104.20.60.209
Public Scan
Submitted URL: http://www.bleepingcomputer.com/news/security/morgan-stanley-reports-data-breach-after-vendor-accellion-hack/
Effective URL: https://www.bleepingcomputer.com/news/security/morgan-stanley-reports-data-breach-after-vendor-accellion-hack/
Submission: On September 02 via manual from US
Effective URL: https://www.bleepingcomputer.com/news/security/morgan-stanley-reports-data-breach-after-vendor-accellion-hack/
Submission: On September 02 via manual from US
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/morgan-stanley-reports-data-breach-after-vendor-accellion-hack/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/morgan-stanley-reports-data-breach-after-vendor-accellion-hack/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/morgan-stanley-reports-data-breach-after-vendor-accellion-hack/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
*
*
*
*
*
*
* News
* Featured
* Latest
* Microsoft: Windows Server 2022 is now generally available
* FTC bans stalkerware maker Spyfone from surveillance business
* Microsoft kicks unsupported PCs out of Windows 11 preview program
* How to block Windows Plug-and-Play auto-installing insecure apps
* Cisco fixes critical authentication bypass bug with public exploit
* Autodesk reveals it was targeted by Russian SolarWinds hackers
* Transfer, back up, and erase data with this PC transfer bundle for $105
* Windows Terminal now lets you drag and drop folders to open tabs
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Morgan Stanley reports data breach after vendor Accellion hack
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
MORGAN STANLEY REPORTS DATA BREACH AFTER VENDOR ACCELLION HACK
By
SERGIU GATLAN
* July 8, 2021
* 09:19 AM
* 0
Image: Morgan Stanley
Investment banking firm Morgan Stanley has reported a data breach after
attackers stole personal information belonging to its customers by hacking into
the Accellion FTA server of a third-party vendor.
Morgan Stanley is a leading global financial services firm providing investment
banking, securities, wealth and investment management services worldwide.
PLAY Top Articles Video Settings Full Screen About Connatix V128365 Read More
Read More Read More Read More Read More Read More Windows Terminal now lets you
drag and dropfolders to open tabs 1/1 Skip Ad Continue watching after the ad
Visit Advertiser website GO TO PAGE
The American multinational company's clients include corporations, governments,
institutions, and individuals in more than 41 countries.
ENCRYPTED FILES STOLEN TOGETHER WITH DECRYPTION KEY
Guidehouse, a third-party vendor that provides account maintenance services to
Morgan Stanley's StockPlan Connect business, notified the investment banking
company in May 2021 that attackers hacked its Accellion FTA server to steal
information belonging to Morgan Stanley stock plan participants.
The Guidehouse server was breached by exploiting an Accellion FTA vulnerability
in January before the vendor patched it within five days of the fix becoming
available.
Guidehouse discovered the breach in March and the impact to Morgan Stanley
customers in May, when it notified the financial services company of the
incident and that no evidence was found of the stolen data being disseminated
online by the threat actors.
"There was no data security breach of any Morgan Stanley applications," Morgan
Stanley said in data breach notification letters sent to impacted individuals.
"The incident involves files which were in Guidehouse’s possession, including
encrypted files from Morgan Stanley."
However, even though the stolen files were stored in encrypted form on the
compromised Guidehouse Accellion FTA server, the threat actors also obtained the
decryption key during the attack.
Morgan Stanley says that the documents stolen during this incident contained:
* Stock plan participants' names
* Addresses (last known address)
* Dates of birth
* Social security numbers
* Corporate company names
The company added that the files stolen from Guidehouse's FTA server did not
contain passwords information or credentials that the threat actors could use to
gain access to impacted Morgan Stanley customers' financial accounts.
"The protection of client data is of the utmost importance and is something we
take very seriously," a Morgan Stanley spokesperson told BleepingComputer. "We
are in close contact with Guidehouse and are taking steps to mitigate potential
risks to clients."
CLOP GANG AND FIN11 BEHIND SERIES OF ACCELLION HACKS
While the attackers' identity was not disclosed in Morgan Stanley's data breach
notification, a joint statement published by Accellion and Mandiant from
February shed more light on the attacks, directly linking them to the FIN11
cybercrime group.
The Clop ransomware gang has also used an Accellion FTA zero-day vulnerability
(disclosed in December 2020) to steal data from multiple companies.
Accellion has said that roughly 300 customers used the 20-year-old legacy FTA
software, with less than 100 of them being breached in these attacks.
Starting in January, BleepingComputer has reported multiple data breaches
impacting companies and organizations after their Accellion FTA servers were
compromised, allowing the cybercrime groups to exfiltrate sensitive information.
So far, these threat actors have hit energy giant Shell, cybersecurity firm
Qualys, the Reserve Bank of New Zealand, Singtel, supermarket giant Kroger, the
Office of the Washington State Auditor ("SAO"), the Australian Securities and
Investments Commission (ASIC), and multiple universities and other
organizations.
In February, Five Eyes members have also issued a joint security advisory on
these attacks and extortion attempts.
RELATED ARTICLES:
T-Mobile CEO: Hacker brute-forced his way through our network
Nokia subsidiary discloses data breach after Conti ransomware attack
T-Mobile data breach just got worse — now at 54 million customers
AT&T denies data breach after hacker auctions 70 million user database
CISA shares guidance on how to prevent ransomware data breaches
* Accellion
* Data Breach
* Morgan Stanley
* Facebook
* Twitter
* LinkedIn
* Email
*
SERGIU GATLAN
Sergiu Gatlan is a reporter who covered cybersecurity, technology, Apple,
Google, and a few other topics at Softpedia for more than a decade. Email or
Twitter DMs for tips.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Fired NY credit union employee nukes 21GB of data in revenge
* Cybercriminal sells tool to hide malware in AMD, NVIDIA GPUs
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2021 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT