Accellion FTA | How a Legacy File Transfer Tool Fueled a Global Extortion Campaign With guest co-hosts Christopher Russell, CISO at tZERO Groupand Benjamin Lipczynski, Director of Cyber Security & Regulatory Services at Origina In late 2020, attackers did not target the cloud.They did not exploit a modern SaaS platform.They went after a quiet, aging file transfer appliance that had been sitting in enterprise environments for nearly two decades.The Accellion File Transfer Appliance (FTA) was still moving contracts, legal documents, financial records, and sensitive data across governments, universities, and global enterprises. Long past its intended design horizon, it remained trusted. And largely unseen.Then a cluster of zero-day vulnerabilities was exploited.Attackers linked to FIN11 used the flaws for large-scale data exfiltration. The stolen data was then handed off to the Clop, which launched a public leak-site extortion campaign.No ransomware encryption.Just stolen files and pressure.Victims included Shell, Kroger, the Reserve Bank of New Zealand, multiple universities, and public-sector agencies worldwide. In this episode of The CISO Signal | True Cybercrime Podcast, we break down how legacy systems quietly become high-consequence risk, why patching alone could not fix the underlying problem, and what happens when attackers specialize across exploitation and extortion. This is not a story about ignoring upgrades.It is a story about systems that outlive their assumptions. 🎙 Guest Co-Hosts Christopher Russell:Chief Information Security Officer, tZERO Group👉 www.tzero.com 👉 / tzero Benjamin Lipczynski:Director, Cyber Security & Regulatory Services, 🤝 Episode Sponsor: Origina👉 www.origina.com👉 / origina This episode is sponsored by Origina, an independent provider of third-party software support and lifecycle governance for mission-critical enterprise systems. Origina works with security, IT, and risk leaders to safely operate, harden, and govern systems that may be aging, end-of-life, or under vendor upgrade pressure, without forcing rushed or unnecessary migrations. Their approach focuses on control, stability, and evidence-based decision making, especially in environments where downtime or disruption is not an option. 🔍 Episode Topics • Why legacy file transfer tools stayed in production for decades• How multiple zero-days were exploited in rapid succession• The handoff between initial access groups and extortion operators• Why many victims learned of the breach through leak sites• Patching vs architectural limits in aging systems• How security leaders can manage legacy risk without panic-driven upgrades 🧊 The aftershock By early 2021, global CERT teams urged organizations to migrate off Accellion FTA immediately, citing its end-of-life status and ongoing risk. Multiple lawsuits followed, along with increased regulatory scrutiny of legacy tools embedded in sensitive workflows. The Accellion breach became a reference point for a broader industry reckoning around technical debt, governance, and the hidden risk of systems that are still working right up until the moment they fail. 🧩 About The CISO Signal True cybercrime storytelling with real CISO lessons.Subscribe so you never miss an investigation.👉 @thecisosignal 👉 www.linkedin.com/company/the-ciso-signal 👉 www.theCISOsignal.com #CISOSignal #AccellionBreach #Clop #FIN11#LegacySystems #DataExtortion
