Finastra, a leading financial technology provider based in London, has reported a data breach that exposed personal information of its customers after unauthorized attackers gained access to its systems between October and November 2024. The company, which provides financial software solutions to over 8,100 institutions, including 45 of the world’s top 50 banks, disclosed the breach on February 12, 2025.
Impacted individuals are urged to remain vigilant by monitoring financial statements, updating passwords, and staying alert to phishing attempts. For more information, visit our guide on how to protect your information after a data breach and minimize potential harm.
Finastra Data Breach Details
The breach was initially identified when Finastra detected suspicious activity involving a Secure File Transfer Platform (SFTP) that they use to provide technical and customer support for their products. The unauthorized access occurred at various times between October 31, 2024, and November 8, 2024, during which the attackers accessed and allegedly obtained certain files stored on the platform.
Finastra has assured that they immediately took steps to secure their systems and has confirmed that the unauthorized party no longer has access to the data. While the company believes the risk of misuse is low, a thorough investigation was conducted to determine if any personal information was exposed. The breach was found to involve personal data, including names, but the full scope of the information taken has not been fully revealed.
As part of the response, Finastra has been working closely with law enforcement agencies, including the FBI, and has implemented enhanced security measures to prevent future breaches.
Finastra has informed those affected by the breach and provided guidance on steps they can take to protect themselves from potential identity theft. This includes following recommendations from the Federal Trade Commission (FTC) and reviewing the “Information About Identity Theft Protection” guide provided to individuals.
The breach is believed to be connected to a post made by the cybercriminal known as “abyss0” on the BreachForums online community. The threat actor claimed to have stolen and sold 400GB of data from Finastra’s network, which has raised concerns over the potential widespread impact on financial institutions that rely on the company’s software.
