WASHINGTON — A ransomware group known as Storm has claimed responsibility for cyberattacks against five U.S. banks holding approximately $6.1 billion in combined assets, along with $614-million Insight Credit Union in Winter Springs, Fla., with two of the six financial institutions confirming data breaches.
As the CU Daily reported here, Insight notified members of the breach on Nov. 9.
According to reporting by American Banker on Nov. 11, the attacks have raised questions about the security of third-party technology providers used by financial institutions and the potential exposure of sensitive consumer information.
The five banks and Insight Credit Union collectively hold approximately $6.7 billion in assets, according to regulatory call reports cited by American Banker.
Victimized Institutions
The ransomware group has identified the following institutions as victims:
- Sawyer Savings Bank, Saugerties, N.Y.
- Pioneer Bank, Albany, N.Y.
- The Cecilian Bank, Cecilia, Ky.
- First Secure Bank Group, Illinois
- Poca Valley Bank, Walton, W.Va.
- Insight Credit Union, Winter Springs, Fla.
American Banker reported that only Sawyer Savings Bank and Insight Credit Union have publicly confirmed data breaches. The other four banks have not publicly confirmed or denied incidents, and their inclusion on Storm’s website does not establish that their systems were compromised.
None of the six institutions responded to American Banker’s requests for comment.
Insight CU Reports Exposure of Personal, Financial Information
As the CU Daily reported, Insight Credit Union reported a data breach to the attorneys general of Texas and Vermont on Nov. 6, according to American Banker and cybersecurity reporting by Teiss.
The Texas disclosure identified 656 residents of that state whose information was affected.
According to Teiss, Storm claimed on Sept. 15 that it had stolen approximately 209 gigabytes of data from the credit union and threatened to publish the information on the dark web.
The information identified in the breach disclosure included:
- Names and Social Security numbers.
- Driver’s license numbers and other government-issued identification.
- Financial account numbers.
- Credit and debit card information.
The disclosures did not establish the cause of the incident or confirm the amount of data Storm claimed to have stolen.
New York Bank Reports More Than 16,000 Affected
Sawyer Savings Bank, a $285-million institution in Saugerties, N.Y., experienced a network disruption Aug. 3 that forced it to close its branches for approximately one week.
According to American Banker, the disruption originated in the systems of a managed service provider responsible for the bank’s information technology operations.
The bank subsequently determined that an unauthorized party had obtained files containing customer names and Social Security numbers.
A disclosure to the Indiana attorney general indicated that 16,069 individuals were affected.
In an Oct. 9 notification filed with New Hampshire authorities, Sawyer said its investigation found no evidence that debit card numbers, financial account numbers or information maintained in its core banking system had been compromised.
Storm listed Sawyer as a victim Aug. 7, according to American Banker.
The bank’s president and CEO, James P. Whitaker, previously indicated that the institution believed the incident resulted from a vulnerability involving an outside vendor.
Microsoft Identifies Possible Connection to Technology Vulnerability
The attacks may be connected to a ransomware operation tracked by Microsoft as Storm-1175, although that connection has not been conclusively established.
According to American Banker, Microsoft Threat Intelligence reported Aug. 7 that Storm-1175 had begun deploying ransomware called StormEncryptor on Aug. 2.
Microsoft said the group was likely exploiting a vulnerability in N-central, a remote monitoring and management platform developed by N-able. The software allows outside technology providers to remotely administer computer systems for multiple clients.
Microsoft had not confirmed that the vulnerability was the entry point for the attacks.
The timing of the reported attacks and the appearance of victims on Storm’s leak website suggest a possible connection, but neither Sawyer’s regulatory disclosures nor Microsoft’s findings conclusively link the bank’s incident to N-central.
New Vulnerabilities Prompt Emergency Shutdown
Separately, N-able temporarily shut down its hosted N-central environments worldwide Nov. 9 after a security researcher publicly disclosed more than 30 additional software vulnerabilities.
According to cybersecurity news outlet BleepingComputer, the company released emergency security fixes Nov. 11 addressing several of the most serious flaws and urged customers operating their own N-central installations to upgrade promptly.
The newly disclosed vulnerabilities are separate from the flaw Microsoft associated with Storm-1175 in August.
N-able said it had not found evidence that customer environments had been successfully compromised through the latest vulnerabilities, although security researchers reported scanning activity targeting potentially vulnerable systems.
Broader Threat to Financial Institutions
The reported attacks underscore the potential consequences for financial institutions that rely on outside technology providers to operate critical systems.
A compromise at a managed service provider can potentially expose multiple customers because those companies often maintain privileged access to the networks they administer.
Cybersecurity intelligence provider Brandefense reported that Storm had listed 88 organizations on its leak website between August and October, with U.S. organizations accounting for approximately 70% of those claims.
Financial services was among the sectors most frequently targeted, according to Brandefense. The company cautioned that inclusion on a ransomware group’s leak website does not independently establish that an organization suffered a confirmed breach.
For the five banks and Insight Credit Union, the extent of any additional compromise remains unclear, as does whether any of the institutions paid a ransom.
The confirmed breaches at Sawyer and Insight nevertheless demonstrate the potential exposure of sensitive personal information, including Social Security numbers and financial account details, when cybercriminals successfully penetrate financial institutions or their technology providers.
