There was a data leak at Shell

 Shell provided information about a security incident involving a data leak. According to previous investigations, personal data may also have fallen into unauthorized hands.

Last December, the Accellion FTA (File Transfer Appliance) revealed a serious zero-day security flaw that has been exploited several times by some cybercrime groups in attacks on large corporations and institutions. According to Accellion, about 25 of its customers using the vulnerable device have leaked data through the vulnerability. These included Singtel, Kroger, ASIC, and the Reserve Bank of New Zealand, among others. And by now, Shell has also been added to the list of victims.

 

Shell’s IT operator and security team have been investigating a security incident in recent weeks, the results of which have been released recently. According to this, due to an Accellion FTA security flaw also used at Shell, unknown perpetrators had access to confidential files. Attackers were also able to capture personal information and shareholder-related information through a file-sharing device. The company has not yet disclosed how many people involved and what kind of data could have been obtained by unauthorized persons. It merely indicated that it had already notified the parties concerned and was working closely with the authorities to thoroughly investigate the circumstances of the case.

 

Shell stressed that there are currently no indications that the attackers gained access to the company’s other IT systems during the incident. This is because the vulnerable FTA device operated in an isolated environment and no other resources could be accessed directly from it. He also indicated that he is working to improve his information security risk management and continuously monitor his systems.

 

It remains a mystery who may have stood behind the attack on Shell. All you can know is that the vulnerability of Accellion FTA has been the most active so far by a group spreading a blackmail program called Clop, and has caused many organizations unpleasant days, mainly through data leakage.