Shell Disclosed Third-Party Data Breach Due To Vulnerable Accellion FTA

Joining the list of victims suffering cybersecurity issues following the Accellion FTA bug exploit, now comes Shell. Recently, the energy giant has confirmed a data breach after the attackers targeted Shell by exploiting vulnerable Accellion FTA.

Shell Data Breach

In a recent security notice, the energy giant Shell has confirmed a security incident. The Royal Dutch Shell plc, commonly known as Shell, is a multinational oil and gas firm operating in many countries globally.

As elaborated in the notice, Shell suffered a data breach that happened due to the Accellion FTA bug. The attackers presumably exploited the vulnerable Accellion FTA appliance that the firm used for transferring large files.

Upon noticing the breach, Shell immediately contained the attack and started investigations. Also, they involved the relevant authorities in the investigations.

What they have disclosed is that the incident happened for a specific period and didn’t affect Shell’s core systems. However, it did cause a breach of data belonging to Shell’s firms and stakeholders. As stated in their notice,

There is no evidence of any impact to Shell’s core IT systems as the file transfer service is isolated from the rest of Shell’s digital infrastructure…
The ongoing investigation has shown that an unauthorized party gained access to various files during a limited window of time. Some contained personal data and others included data from Shell companies and some of their stakeholders.

Shell has confirmed to have informed the affected stakeholders about the matter and the subsequent steps to “address the risks.”

Accellion FTA Exploit Domino Effect

Accellion FTA exploits triggered chaos after the attackers started exploiting a zero-day bug in its file-sharing product File Transfer Appliance (FTA). While the firm had already announced the end-of-life for this product, Accellion still addressed the bug and deployed fixes.

Besides, it also announced sunsetting the product after the bug went under attack.

However, despite the availability of alternative options, many customers continued to use the vulnerable FTA service. Thus, they started facing breaches and ransomware attacks. Two of such victims include Singtel and the Reserve Bank of New Zealand. And now, Shell has joined the list.

Related posts

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

C2A Security’s EVSec Risk Management and Automation Platform Gains Traction in Automotive Industry as Companies Seek to Efficiently Meet Regulatory Requirements

ZenHammer Memory Attack Exploits Rowhammer Against AMD CPUs