Finastra data breach: files taken from its file transfer platform on October 31, 2024, 888,627 people

What happened at Finastra?

Finastra identified the incident on November 7, 2024 and says it was limited to its secure file transfer platform, Aspera. The intruder had access at various times between October 31 and November 8, 2024, and took files on the first day. It reported the incident to federal law enforcement, including the FBI, and brought in incident response firms.

Date	What happened	Source
October 31, 2024	Intruder takes files from the platform	Finastra filing; Oregon list
November 7, 2024	Finastra identifies the incident	Finastra filing; Oregon list
November 8, 2024	Last access; Finastra tells its bank customers about the incident	Finastra filing; KrebsOnSecurity
November 19, 2024	KrebsOnSecurity reports the incident	KrebsOnSecurity
February 12, 2025	Notice reaching 92,350 Indiana residents	Indiana 2025 report
July 3, 2025	Notice to New Hampshire (281 residents) and Oregon (888,627)	Finastra filing; Oregon list

The Indiana notice came 104 days after the files were taken, and the New Hampshire and Oregon notice 245 days after. The notice-delay guide compares that with other notices.

What did Finastra tell banks in November 2024?

Finastra told its bank customers on November 8, 2024 that its security team had detected suspicious activity the day before on its internally hosted file transfer platform, KrebsOnSecurity reported on November 19, 2024. That notice said a threat actor had claimed on the dark web, on November 8, to hold data taken from the platform.

According to the customer notice Krebs quoted, the intruder did not deploy malware or change customer files, and no files beyond the ones taken were viewed. In a later update to clients, Finastra said initial evidence pointed to compromised credentials. Krebs reported that Finastra serves about 8,100 financial institutions, including 45 of the world's top 50 banks, which is why one file-transfer breach reached so many bank customers.

How many people did the Finastra breach affect?

Record	Notice	Figure
Indiana Attorney General, 2025 report	February 12, 2025	92,350 Indiana residents
New Hampshire Department of Justice filing	July 3, 2025	281 New Hampshire residents
Oregon Department of Justice list	July 3, 2025	888,627 people

The largest figure, 888,627, is Oregon's total for the July notice. Indiana's February figure is a count of Indiana residents only. The records do not say whether the July mailing repeats people already told in February.

Washington's attorney general lists a notice from Finastra Technology, Inc. reported on July 3, 2025, with 679 Washingtonians affected. Its record names names, Social Security numbers and full dates of birth as the information compromised. The figure counts Washington residents only.

Why did I get a letter from Finastra?

Because your bank, or an employer in banking, uses Finastra's software. The filing says most of the people notified are associated with or employed by organizations that use Finastra's financial software and get support from Finastra for it. The New Hampshire filing names one client that directed the notice there: Old National Bank. The guide to why you got a breach letter from a company you never dealt with explains vendor notices like this one.

What information was exposed?

Names and Social Security numbers, the filing says; each letter fills in the person's own data elements. Finastra says it has no indication that the third party copied, kept or shared the data further, and it describes the risk to individuals as low.

What is Finastra offering?

Twenty-four months of credit monitoring and fraud protection at no cost, with a toll-free number in each letter. The guide to credit monitoring offers explains what a free credit freeze adds.

What the record leaves open

• Which banks' customers make up the 888,627, beyond the one bank named in New Hampshire.
• Why a second round of notice came in July 2025, five months after the February letters.
• Whose credentials were used; Finastra's update to clients pointed to compromised credentials without saying more.