Cabinet Office: the FileZen file sharing storage used by its staff came under a zero-day attack, and non-public data on 231 people may have leaked

1. 2021-04-22

   The Cabinet Office announced the case. In mid-January, the company that operates the Cabinet Office LAN had detected unauthorized access to the file sharing storage. The Cabinet Office had cut the device off from the network and investigated with the help of the National center of Incident readiness and Strategy for Cybersecurity. [1] [2] [3]

2. 2021-04-26

   The Cabinet Office planned to resume use of the device after taking measures against a recurrence. [1] [2]

Several vulnerabilities in FileZen, a file transfer appliance by Soliton Systems, were exploited. When the attack was found, some of the flaws had no fix, so it was a zero-day attack. Exploiting CVE-2021-20655, fixed in March, requires administrator rights, and the attackers appear to have obtained them through CVE-2020-5639, which allows passwords to be stolen. [1]

The device could be reached directly from the internet. The Cabinet Office said the attackers did not get into its network. [1] [3]

The device is used by staff of the Cabinet Office, the Cabinet Secretariat, the Reconstruction Agency and the Personal Information Protection Commission. Files on the storage were tampered with, but no access logs remained, so whether any left the device is unknown. The files held non-public names, affiliations and contact details of 231 people, which may have leaked. The Cabinet Office said it does not normally keep information classified at confidentiality level 3, which equals secret documents, on the device. [1] [2] [3]

The Cabinet Office explained and apologized to the 212 people whose contact details it had. It fixed the vulnerabilities, installed a WAF, and began logging outside access that FileZen had not recorded. It firmly denied a media report of a leak of several gigabytes. [1] [2]