European Banking Authority says email servers targeted by attackers

The European Banking Authority’s email servers were breached using a flaw in Microsoft’s Exchange Server, but the authority said no data had been taken.

The EBA is an independent EU Authority “which works to ensure effective and consistent prudential regulation and supervision across the European banking sector”, according to its website.

It disclosed a cyber attack on its email servers on March 7, and said it had launched an investigation with its IT service provider, forensic experts and other authorities.

The authority said it had taken its email systems offline “as a precautionary measure”.

In an update overnight, the EBA said it is continuing to investigate the incident.

“We are deploying additional security measures and close monitoring in view of restoring the full functionality of the email servers,” it said in a statement.

“At this stage, the EBA email infrastructure has been secured and our analyses suggest that no data extraction has been performed and we have no indication to think that the breach has gone beyond our email servers.

“The EBA has taken all precautionary measures to protect personal and other data and will take additional steps and provide further updates as necessary.”

Microsoft last week strongly urged customers with Exchange Server installations to apply patches that addressed critical vulnerabilities that were being exploited by Chinese nation state hackers to steal information and install malware.

More than 20,000 US-based organisations are reported to have been similarly compromised using the flaw.

Reports on the number of potentially vulnerable Exchange servers in Australia have also surfaced in recent days, though iTnews has so far been unable to verify if these numbers are accurate.