Extortion Group Leaks Sensitive Finzly Network Data
The stolen firewall credentials and maps provide technical details on connections between private banks and Federal Reserve systems.
Updated on Oct. 30, 2026 in Cybersecurity
Live Poll
Do you trust that financial vendors sufficiently protect the infrastructure connecting banks to the Federal Reserve?
The extortion group n0n has published firewall keys and network configuration files stolen from Finzly, a firm that manages connections between financial institutions and the Federal Reserve. Finzly confirmed that the leak originated from an unauthorized intrusion into a single device at a backup data center.
Why it matters
The breach exposes specific network topography and security rules for critical national payment infrastructure, such as FedNow and FedACH. While payment services remain functional, the disclosure of credentials used to link banks to Federal Reserve systems highlights significant supply chain vulnerabilities in the financial technology sector.
The leaked data includes network map files and firewall credentials associated with Fortinet FortiGate hardware. While the configuration files date back to 2023, these assets previously governed the routing and security protocols for traffic flowing between private banking networks and Federal Reserve payment gateways.
The players
Finzly
A financial technology firm that provides infrastructure for bank-to-Federal Reserve payment systems including FedNow and FedACH.
Federal Reserve
The central banking system of the United States that manages critical national payment settlement services.
n0n
An extortion group that demands payments in exchange for non-disclosure of stolen corporate credentials and configuration data.
The details
The breach involved an unauthorized third party gaining access to a single device within a backup data center, allowing them to exfiltrate sensitive configuration files. These files reveal firewall rules and credentials designed to manage secure tunnels between Finzly and the Federal Reserve. Finzly has since performed a rotation of system keys and credentials to mitigate the risk posed by the exposed access parameters.
Timeline
2023: Firewall configuration settings were originally established.
October 15, 2026: Configuration file passwords were decrypted by the extortion group.
Week of October 25, 2026: Extortion group n0n published the stolen files online.
The Tech Race
This incident follows a pattern of supply chain targeting similar to the 2023 MOVEit transfer vulnerability, where infrastructure providers are leveraged to access deeper financial networks. It emphasizes the ongoing struggle of firms to secure legacy firewall configurations against groups targeting critical payment backbones.
Clients of the 11 affected banks and credit unions may see heightened monitoring of transaction traffic as firms audit their connections to Federal Reserve payment rails. While personal banking operations are currently stable, institutions are likely accelerating password and security key rotations to neutralize the published configurations.
The takeaway
The exposure of specific firewall rules for FedNow and FedACH connections underscores the persistent risk of credential leaks in outsourced banking infrastructure. Financial security teams should prioritize auditing legacy configuration files dated 2023 or earlier to ensure they do not still govern active production gateways.
Further reading
For broader insights into how critical infrastructure security is evolving, explore our coverage of Cybersecurity.
Source note: This article includes information reported by American Banker.
Live Poll
Do you trust that financial vendors sufficiently protect the infrastructure connecting banks to the Federal Reserve?
