Accellion and the file transfer server nobody owned

The week

On February 1, 2021, the Washington State Auditor’s Office disclosed that personal information about people who had filed unemployment claims in the state had been exposed through a breach of Accellion’s File Transfer Appliance. The auditor used the service to exchange files. It had received the claimant data from the state’s Employment Security Department for its review of the large-scale unemployment fraud the state suffered in 2020.

The auditor was one of many Accellion customers affected. Attackers had exploited vulnerabilities in the product, a file sharing appliance about two decades old that Accellion was already retiring in favor of a newer platform, from December 2020 into January 2021. Other disclosed victims included public bodies in New Zealand and Australia, universities, a law firm and a U.S. grocery chain. Many received extortion demands, and stolen data from some appeared on a leak site associated with the Clop ransomware group.

The Accellion breaches were easy to file as a vendor problem: a legacy product, unpatched flaws, a criminal group. That reading misses why the same pattern returned again and again. Managed file transfer occupies an awkward place in public sector architecture. It moves some of the most sensitive data an agency holds, between agencies, auditors, contractors and partners, yet it rarely appears on anyone’s list of critical systems. Four conditions turned it into the perimeter, and each needs its own fix: ownership, lifecycle, retention and custody.

Ownership: a tool that belongs to everyone and no one

File transfer tools are usually bought to solve one exchange, such as sending audit extracts, receiving claims files or sharing records with a contractor. Each use is small, so a program office or an operations team buys the tool, and nobody reviews it as an enterprise platform. Over time it gathers connections to dozens of partners, each set up by a different person for a different project.

The result is a system that touches highly sensitive data without an executive owner. When the vendor announces end of life or a critical patch, nobody is accountable for acting fast. Security teams may not even know the appliance exists, because it was installed as a utility.

The first fix is administrative. Give file transfer an owner, put it on the list of critical systems, and require that owner to maintain three things:

• A register of partner connections, with the business purpose, the internal sponsor and the date each was last used.
• A list of data types that flow through each connection, so the agency knows what a compromise would expose.
• A review cycle that closes connections no current program depends on.

A first review usually finds connections no current program needs. Closing them is an immediate reduction in exposure at no cost.

Lifecycle: legacy appliances outlive their support

The Accellion appliance was an old product its maker was encouraging customers to leave. Customers who had not migrated were running technology near the end of its supported life, on a platform attackers had studied closely.

Public agencies face real obstacles to replacement. Budget cycles, procurement timelines and the effort of reconnecting every partner to a new platform all slow it down. Those obstacles are the reason lifecycle planning has to start early. An end-of-life notice should trigger a funded migration plan with a date, not a line on a risk register that waits for next year’s budget.

Where migration cannot happen quickly, compensating steps are available. Internet exposure can be limited to known partner addresses. Monitoring can flag unusual download volumes or new administrative accounts. Retention on the device can be shortened. Each step buys time; none makes an unsupported product safe.

Retention: transfer tools quietly become storage

A transfer service is meant to move data, not keep it. In practice, files often stay on the appliance long after the recipient has downloaded them. Sometimes nobody configured deletion. Sometimes users rely on the tool as a convenient archive. When attackers reach the appliance, they find a store of sensitive files, not a few in transit.

This is the most tractable of the four conditions. Automatic deletion after confirmed delivery, or after a short fixed period, limits what any compromise can expose. It costs little and needs no new system. The trade-off is minor inconvenience. Partners who miss a download must ask for the file again, which is a small price for a much smaller store of stolen data.

Retention also interacts with records law. Some files on a transfer platform may be public records, so the deletion rule should be agreed with the records officer and the copy of record kept in the system meant to hold it. Retention settings should be checked, not assumed. A quarterly report of the oldest file on each transfer platform, and of total volume held, shows whether the policy is working.

Custody: your data on someone else’s appliance

The Washington case had a feature that matters for every agency. The people affected were unemployment claimants. The data came from the Employment Security Department. The breached system belonged to the auditor, another state office that had received the data for a legitimate oversight purpose.

Residents do not distinguish between agencies. When data shared for oversight, research or contracted services is exposed, the originating agency bears much of the reputational cost and often much of the notification work. Data sharing agreements should therefore specify how data will be transferred, where it will rest, for how long, and what security the recipient will maintain. They should also say who notifies whom, and how fast, if the recipient is breached. Agencies should check with counsel on how their state’s breach laws allocate notification duties in these arrangements.

The four conditions reinforce each other. An unowned tool is not migrated on time, accumulates retained files, and holds data that belongs to other organizations. None of the fixes depends on buying a new product, though a migration may follow from them.

With hindsight

Accellion was the first of a series. The same criminal group, or actors associated with it, later exploited other managed file transfer products. Fortra’s GoAnywhere was hit in early 2023, and Progress Software’s MOVEit Transfer in mid-2023, which affected a very large number of organizations including many government bodies. Cleo’s products followed at the end of 2024. Each time the method was similar: a flaw in an internet-facing transfer service, mass data theft, and extortion without encryption.

The repetition shows the problem was structural, not specific to one vendor. Agencies that inventoried their transfer services, set retention limits and wrote transfer terms into data sharing agreements after 2021 were better placed when MOVEit hit. By 2026 managed file transfer is widely recognized as high-value infrastructure, although many agencies still struggle to name a single owner for it.