Security News > 2021 > July > Morgan Stanley Hit by Accellion Hack Through Third-Party Vendor
Investment banking firm Morgan Stanley has informed the New Hampshire Attorney General that personal information of some customers was compromised through a third-party vendor that was using the Accellion FTA service.
In a letter submitted last week to the New Hampshire Attorney General's office, Morgan Stanley said Guidehouse informed them in May 2021 that some threat actors had exploited Accellion FTA to access Morgan Stanley documents that included personal information of StockPlan Connect participants.
The stolen files, Morgan Stanley says, were encrypted, yet the adversary "Was able to obtain the decryption key during the security incident, due to the Accellion FTA vulnerability."
The vendor only discovered the attack in March 2021, and informed Morgan Stanley two months later, "Due to the difficulty in retroactively determining which files were stored in the Accellion FTA appliance when the appliance was vulnerable."
"Guidehouse has informed Morgan Stanley that it found no evidence that Morgan Stanley's data had been distributed beyond the threat actor," the investment banking firm said.
Morgan Stanley says that 108 New Hampshire residents were affected in the incident, but the company hasn't provided information on how many other individuals were impacted.