Connect with us

Hi, what are you looking for?



Morgan Stanley Hit by Accellion Hack Through Third-Party Vendor

Investment banking firm Morgan Stanley has informed the New Hampshire Attorney General that personal information of some customers was compromised through a third-party vendor that was using the Accellion FTA service.

Investment banking firm Morgan Stanley has informed the New Hampshire Attorney General that personal information of some customers was compromised through a third-party vendor that was using the Accellion FTA service.

Accellion’s file transfer service was hacked in December 2020 and January 2021, when a threat actor linked to the FIN11 cybercrime group exploited several vulnerabilities in FTA to access files pertaining to tens of organizations.

One of the organizations affected by the FTA incident is Guidehouse, which provides account maintenance services to Morgan Stanley’s StockPlan Connect business.

In a letter submitted last week to the New Hampshire Attorney General’s office, Morgan Stanley said Guidehouse informed them in May 2021 that some threat actors had exploited Accellion FTA to access Morgan Stanley documents that included personal information of StockPlan Connect participants.

The stolen files, Morgan Stanley says, were encrypted, yet the adversary “was able to obtain the decryption key during the security incident, due to the Accellion FTA vulnerability.”

Some of the information contained in the stolen documents included names, addresses, birth dates, Social Security numbers, and corporate company names.

“Note that any data within these files did not contain passwords that could be used to access financial accounts,” Morgan Stanley notes in the letter.

Advertisement. Scroll to continue reading.

Guidehouse apparently patched their FTA instance within 5 days after the vendor released security updates, but the threat actor had already breached the service at that time.

However, the vendor only discovered the attack in March 2021, and informed Morgan Stanley two months later, “due to the difficulty in retroactively determining which files were stored in the Accellion FTA appliance when the appliance was vulnerable.”

“Guidehouse has informed Morgan Stanley that it found no evidence that Morgan Stanley’s data had been distributed beyond the threat actor,” the investment banking firm said.

Morgan Stanley says that 108 New Hampshire residents were affected in the incident, but the company hasn’t provided information on how many other individuals were impacted.

Related: Report: Accellion Failed to Notify Customers of FTA Zero-Day

Related: University of California Confirms Personal Information Stolen in Cyberattack

Related: Continuous Updates: Everything You Need to Know About the Kaseya Ransomware Attack

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Artificial Intelligence

The degree of danger that may be introduced when adversaries start to use AI as an effective weapon of attack rather than a tool...