Data Security Risk Due To File-Transfer Software Vulnerabilities

Data and personal information shared through a third-party file transfer system is potentially at risk, according to recent alerts issued by the Canadian Centre for Cyber Security and the U.S. Cybersecurity and Infrastructure Security Agency.^[1

In cases where data is compromised, for example, via ransomware attacks, the ultimate accountability and responsibility for the data lies with the organization that has custody and control of the data. This means organizations who use these third-party tools remain accountable to the individuals to whom the personal information pertains, including potential legal notifications.

Discovered zero-day vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency has reported the discovery of serious vulnerabilities in Cleo's managed file transfer platforms, including Cleo Harmony, VLTrader, and LexiCom.^[2These widely used platforms for secure file exchanges have been actively exploited by cybercriminals,