Extortion group n0n threatens to leak Finzly payment infrastructure secrets, with Friday deadline

A cyber extortion group calling itself n0n says it will publish Finzly’s “access secrets for payment infrastructure” and cloud access keys if no settlement is reached. For banks and credit unions, the point is obvious: a vendor breach can turn into a multi-institution problem fast, especially when that vendor sits between core systems and payment rails.

1. n0n added Finzly to its leak site over the weekend, according to ransomware.live, which tracks leak sites used by ransomware and extortion groups. The group says it will publish “network configuration and access secrets for payment infrastructure” and “cloud environment topology and access keys” at 8:20 p.m. Eastern time on Friday unless Finzly pays what the listing calls a “settlement.”
2. Finzly said it “recently learned that a cyber extortion group has named Finzly in an online claim” and is “actively investigating the claim with external cybersecurity experts,” according to a spokesperson who spoke to American Banker. The company said it is “fully operational.” The spokesperson did not say whether credentials were taken, whether Finzly received a ransom demand, whether clients were notified, or whether digital keys to its systems were changed.
3. As of Tuesday afternoon, n0n had not posted any sample data on its leak site, which leaves the credibility of the claim unresolved. Cyfirma said n0n has “credible access to at least some listed victims,” and rated that confidence as “moderate.”
4. Finzly, based in Charlotte, North Carolina, sells BankOS, a platform that links banks to ACH, Fedwire, RTP, FedNow and Swift through a single connection. Its website lists 11 banks and credit unions as clients: Synovus, First Citizens Bank, First Horizon, EverBank, Columbia Bank, Customers Bank, Live Oak Bank, 1st Source Bank, Metropolitan Commercial Bank, United Community Bank and Wings Credit Union.
5. None of those 11 institutions immediately answered questions about the claimed breach. The leak post does not say whether the keys, if genuine, would reach client payment traffic or customer data, but that distinction is usually the whole game; one vendor’s compromise can expose multiple banks at once. American Banker pointed to this year’s ShinyHunters theft from Jack Henry as an example of how vendor incidents can spill into client data at scale.