Finzly BankOS FortiGate Configuration Leak: Fed Firewall Keys Published by n0n

Updated October 31, 2026, 3:00 AM CT. Finzly, whose BankOS platform connects banks to ACH, Fedwire, FedNow and other payment networks, confirmed that an unauthorized third party accessed a single device in its backup data center containing configuration information. The extortion group n0n published files that American Banker says make up the configuration of a Fortinet FortiGate firewall guarding the link Finzly's bank clients use to send payment instructions to the Federal Reserve, annotated as a "2023 config" whose secrets "were decrypted on Oct. 15." Finzly says it rotated keys and credentials; the Fed says its services were not impacted. This page lists what is verified and what is not. Cloudskope's analysis is in Finzly Told Banks They Need Evidence, Not Trust. Then the Keys to Its Fed Firewall Went Public.

Timeline (Central Time)

• November 19, 2019. Fortinet advisory FG-IR-19-007: FortiOS encrypts configuration secrets with a hard-coded key; the fix (private-data-encryption) is opt-in and disabled by default.
• June 25, 2025. CISA adds CVE-2019-6693 to its Known Exploited Vulnerabilities catalog, ransomware use "Known."
• August 7, 2026. Finzly posts a job to manage its FortiGate firewalls and provide audit evidence for SOC 1/2, PCI DSS, FFIEC and NYDFS examinations.
• September 3, 2026. Finzly announces Assure, an AI-powered security and assurance layer; the page is updated October 13.
• October 6. FBI and U.S. Secret Service advisory JCSA-20261006-01 on FortiBleed, a credential campaign against FortiGate firewalls (more than 86,644 compromised devices per SOCRadar).
• October 13. Newest of 25 Finzly employee credentials in SOCRadar's infostealer telemetry (window from June 2026).
• October 15. Per American Banker's reading of the leaked files, the configuration's secrets "were decrypted."
• October 18, 8:23 PM. ransomware.live records n0n's listing for "Finzly Corp": network configuration and access secrets for payment infrastructure; cloud topology and access keys (verified by Cloudskope).
• October 20. Finzly to American Banker: investigating the claim with external experts; "fully operational." n0n deadline set for Friday, October 23, 7:20 PM CT.
• October 27 (Tuesday night). n0n's extended deadline lapses; files published afterward.
• October 30. American Banker reports the leak. Finzly: a single backup-data-center device accessed; keys and credentials rotated; no evidence customer data or access information related to clients' systems compromised; law enforcement notified; communicating with customers. Fed: payment services "were not impacted."

What is unknown

• When the backup-site device was first accessed, and how.
• Whether the device was internet-facing, and what kind of device it was.
• Whether private-data-encryption was enabled, and how the secrets were decrypted.
• Whether the 2023 credentials were still valid in 2026.
• When keys were rotated, and whether rotation covered every secret in the configuration.
• When Finzly notified the Federal Reserve under Operating Circular 5, and when it notified each client.
• Which of the eleven listed clients use the shared Federal Reserve link.
• Whether anything beyond the configuration was accessed.

Stated by Finzly (to American Banker)

• An unauthorized third party accessed a single device in Finzly's backup data center containing configuration information.
• Possession of the configuration information alone does not provide access to Finzly's systems or data; keys and credentials have been rotated.

Reported by American Banker (October 30)

• Five of six published files appear to make up a FortiGate firewall configuration, with a link labeled "FED"; annotations say "2023 config" and that secrets "were decrypted on Oct. 15." No customer, bank or transaction data found. Keys not tested.

Confirmed by Cloudskope's direct observation (October 31, 1:55 to 3:00 AM CT)

• ransomware.live lists "Finzly Corp" under N0n, discovered 01:23:07 UTC October 19, data size blank, status not paid / exposed.
• finzly.com is up and carries no incident statement; newest post October 12.
• Finzly's careers page (August 7, 2026) describes a FortiGate firewall estate.
• No SEC filing mentions Finzly after March 2, 2026; no client has filed an 8-K on the incident.

Assessed by others

• SOCRadar (October 28): n0n's documented intrusions relied on weak or stolen credentials, including credential stuffing against 305 FortiGate SSL VPN devices; no vulnerability exploitation identified. SOCRadar's Finzly telemetry confirms credential theft, not the intrusion method.
• Huntress (via American Banker): decrypting keys from the configuration is "absolutely plausible."

Payment-hub and banking-infrastructure vendors carry client connections to payment networks that never appear in SOC reports. In diligence, request the perimeter-device inventory including disaster-recovery sites, the date every stored secret was last rotated, the status of configuration-backup encryption, infostealer exposure for the target's domain, and the contractual notice terms for incidents that cause no outage. For holders of such businesses, the exposure is client attrition and examiner attention, not this week's headline.