FlagThis

Western Alliance Bank recently disclosed a data breach impacting 21,899 customers. The incident stemmed from a vulnerability in third-party secure file transfer software, highlighting the risks associated with relying on external vendors for critical operations. Attackers exploited a zero-day vulnerability to exfiltrate sensitive files from the bank's systems, prompting an internal investigation after stolen files were leaked online. The breach occurred between October 12 and October 24 of the previous year, but the vulnerability wasn't disclosed by the vendor until October 27, highlighting the time it can take to discover these issues.

The compromised data included names, Social Security numbers, dates of birth, financial account details, driver’s license numbers, tax identification numbers, and even passport information in some cases. The Clop ransomware gang has been attributed to the breach, adding Western Alliance Bank to its leak site after exploiting vulnerabilities in Cleo Harmony and related software. The bank is offering affected customers one year of credit monitoring as a precaution, while urging heightened vigilance for potential identity theft and fraud.

ImgSrc: www.techmonitor

References :

• bsky.app: Arizona-based Western Alliance Bank is notifying nearly 22,000 customers their personal information was stolen in October after a third-party vendor's secure file transfer software was breached.
• Secure Bulletin: Western Alliance Bank data breach: 21,899 customers impacted
• The DefendOps Diaries: Understanding the Western Alliance Bank Data Breach: Lessons in Cybersecurity
• BleepingComputer: Western Alliance Bank notifies 21,899 customers of data breach
• Tech Monitor: Western Alliance Bank confirms data breach affecting over 21,000 customers
• BleepingComputer: Arizona-based Western Alliance Bank is notifying nearly 22,000 customers their personal information was stolen in October after a third-party vendor's secure file transfer software was breached.
• Information Security Buzz: Western Alliance Bank has announced a data breach affecting 21,899 people, that was caused by an October 2024 cyberattack on a third-party file transfer software.
• www.itpro.com: Western Alliance Bank admits cyber attack exposed 22,000 customers

Classification:

• HashTags: #DataBreach #ThirdPartyRisk #Cybersecurity
• Company: Western Alliance Bank
• Target: Customers
• Product: Secure file transfer
• Feature: third-party vulnerability
• Type: DataBreach
• Severity: Medium