Case Study: Accellion FTA compromises organisations and state government agencies In January 2021, the ACSC became aware of cyber actors exploiting vulnerabilities in the legacy Accellion FTA used by a range of organisations. The Accellion FTA is a software that allows for the sharing of files between users; and actors exploiting a vulnerability in the legacy software were able to gain access to content stored on, and accessible by, the organisation’s FTA instance. This activity impacted organisations globally, including Australian organisations, many of which have since retired FTA and migrated to Accellion’s modern content firewall Kiteworks platform, consistent with ACSC and international partners’ advice. On 19 January 2021, the ACSC published an alert, as well as an advisory to ACSC Partners, providing technical advice and mitigation measures to address the vulnerability in the FTA. The ACSC also engaged with a number of Australian organisations identified as users of the Accellion FTA and recommended they investigate their security posture. On 1 March 2021, Accellion announced all FTA vulnerabilities remediated and an end-of-life for its FTA product, effective 30 April 2021. In addition, Accellion offered its FTA customers free forensic assistance, as well as an independent forensic analysis by Mandiant, access to Accellion senior management, migration services to Kiteworks, or migration assistance to customers who elected to terminate their relationship with Accellion. ACSC investigations identified several organisations that were affected by the Accellion compromise, including in the energy, professional and legal services and health sectors, as well as a number of NSW government agencies. On 23 February 2021, the NSW Government publicly released a statement advising that it had established Strike Force Martine to investigate the impacts of the breach on the NSW Government. Transport for NSW and NSW Health are among the agencies that were affected by the incident. Transport for NSW has confirmed there was no third party access to major agency systems including drivers licence systems or the Opal Travel systems. NSW Health has confirmed that medical records in public hospitals were not affected and the software involved is no longer in use by NSW Health. Consistent with ACSC advice, the NSW Government retired all instances of the Accellion FTA as part of the centralised response to protect customer and government data. The ACSC worked closely with Cyber Security NSW to understand the impact of the breach, including to customer data. The global Accellion FTA compromise demonstrates the importance of vendors regularly assessing security vulnerabilities and ensuring prompt notification if any are found, including those posed by third-party service providers that may be using legacy products. The ACSC recommends that organisations mitigate the risk exposure posed by legacy third party products. Cyber actors continue to rapidly leverage publicly reported vulnerabilities in legacy products to target unpatched systems and devices. Agencies running legacy or unsupported software are encouraged to review their risks, implement timely patches, upgrade to newer, supported software, and have an incident response plan in place. 39