Qualys Response to Accellion FTA Data Breach and Investigation | Qualys
Summary: Qualys reported that a threat actor exploited a zero-day vulnerability in its third-party Accellion FTA file-transfer appliance, which it had patched on December 22, 2020, and isolated after an integrity alert on December 24, 2020. Qualys said forensic firm FireEye Mandiant and a second firm concluded the actor did not move laterally from the FTA server into any Qualys environment, and that impact was contained to files on that server.
Key Takeaway: Qualys also reported that the actor posted email addresses taken from the server that had no corresponding file, and paired file names from one customer with other customers' email addresses, which its forensic experts described as a new tactic to make the data look bigger than it is. Other victims' customers have reportedly been emailed directly by the actor, a pattern Qualys said it had no evidence of among its own customers but flagged for the wider community.
Read the original at Qualys Blog ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026