As I noted yesterday on Twitter, Qualys was added to threat actor CLOP’s leak site, raising the question as to whether the firm had been an Accellion client.
They had. Qualys issued a statement later yesterday. It said, in part:
Qualys has confirmed that there is no impact on the Qualys production environments, codebase or customer data hosted on the Qualys Cloud Platform. All Qualys platforms continue to be fully functional and at no time was there any operational impact.
Qualys had deployed the Accellion FTA server in a segregated DMZ environment, completely separate from systems that host and support Qualys products to transfer information as part of our customer support system. Qualys chose the Accellion FTA solution for encrypted temporary transfer of manually uploaded files. There was no connectivity between the Accellion FTA server and our production customer data environment (the Qualys Cloud Platform). The Accellion FTA product is a third-party system fully managed by Accellion.
Read the full statement on Qualys.
Since it was first added to CLOP’s dedicated leak site with a few sample screenshots, the threat actors have since started dumping what they claim are files from the firm. There has been no reported analyses of the files as of the time of this publication and DataBreaches.net has not inspected the files at all at this point.