An extortion group calling itself n0n added bank-payments vendor Finzly to its leak site over the weekend and is threatening to publish "network configuration and access secrets for payment infrastructure" and "cloud environment topology and access keys" at 8:20 p.m. Eastern time on Friday unless a "settlement" is paid, American Banker reported on 20 October. Charlotte, North Carolina-based Finzly sells a platform called BankOS that links banks to ACH, Fedwire, RTP, FedNow and Swift through a single connection; its website lists 11 bank and credit-union clients, among them Synovus, First Citizens Bank, First Horizon and EverBank. Finzly said it "recently learned" it had been named, is investigating with external cybersecurity experts and remains "fully operational", but did not say whether credentials were taken, whether it received a demand, whether it has notified clients, or whether it has rotated keys. n0n had posted no sample of the data as of Tuesday afternoon. Threat-intelligence firm Cyfirma rates "moderate" confidence that n0n has credible access to at least some listed victims, and says the group most likely breaks in with passwords stolen by infostealer malware. n0n launched its leak site on 18 September and has posted 131 listings across 32 countries. Why it matters: one payments vendor's credential exposure can reach many banks at once — ShinyHunters' theft from bank-technology vendor Jack Henry exposed client institutions' account holders this year.

• Source article