A supplier incident with systemic consequences
The ransomware attack that struck Harvest SAS on 27 February 2025 revealed a structural weakness within the financial sector: a strong dependency on SaaS providers that support critical operations. When a single supplier becomes unavailable, the impact cascades across banks, insurers and wealth management firms.
Harvest initially described the situation as a contained “cyber incident”. On 10 April, the ransomware group Run Some Wares claimed responsibility and began publishing stolen files on a dark-web site. Independent analyses confirmed extensive data exfiltration, including internal documents, accounting and HR records, strategic plans, source code, AI models, password vaults and encryption keys.
What first appeared to be an outage proved to be a deep compromise, exposing both Harvest and the organisations relying on its platforms.
A well-orchestrated attack using established methods
The intrusion likely originated from a remotely accessible virtual machine hosted by a third party, combined with the absence of multifactor authentication on critical accounts. Once inside, the attackers used legitimate administrative tools to map the environment, locate sensitive directories, prepare data exfiltration and deploy ransomware.
The operation follows the now-standard double-extortion model: steal data, encrypt systems and increase pressure by gradually releasing files. Run Some Wares has already targeted several financial, accounting and industrial organisations, applying an aggressive approach aimed at maximising impact.
Supply chain attack
RaaS group
(Run Some Wares)
Third-party ICT
(Harvest)
Information System
(Axa, BPCE, MAIF, Amundi, Swiss Life, …)
A direct and measurable impact on Harvest’s clients
The outage disrupted key workflows for financial professionals. Many organisations reverted to manual processes for days, losing efficiency and visibility over client portfolios and regulatory reporting. The situation also strained relationships with clients who depend on Harvest’s tools for day-to-day operations.
The leak introduces a second layer of risk. Stolen information may fuel targeted phishing attempts, identity fraud or the exploitation of technical secrets. If compromised encryption keys or vaults are reused elsewhere, secondary compromises cannot be excluded.
What the Harvest case reveals about third-party ICT risk
The incident occurs at a moment when regulatory pressure is increasing with DORA and NIS2. Financial institutions must demonstrate full control over their ICT service providers: updated registries, precise contractual requirements, monitoring of dependencies, continuity planning and realistic resilience scenarios.
Many organisations still underestimate the operational weight of their SaaS providers. These suppliers are no longer peripheral vendors; they are part of the core infrastructure that supports essential business processes.
Preventing a similar scenario
Reducing exposure requires clear technical expectations for ICT providers: systematic strong authentication, strict segmentation, secure management of keys and secrets, and targeted supervision of remote access and hosted environments.
Organisations also need an accurate, continuously updated view of their third-party ecosystem, including interconnections, data handled and criticality. Resilience exercises should simulate the real consequences of losing a major SaaS provider or facing a public data leak.
Executive involvement is essential. Third-party cyber risk has become a business-level issue, impacting continuity, regulatory compliance and client trust.
Our support
Stroople helps leaders assess their attack surface, including risks originating from third-party ICT providers. We strengthen governance, contracts, external monitoring and compliance with DORA, NIS2 and supervisory expectations. Our mission: secure your operations, protect your clients and demonstrate full control of your third-party cyber risks.
Share:
Cybersecurity in the age of AI
Download our white paper to gain the clarity and perspective you need.
NIS2 Compliance Guide
Download the guide now and take the first step toward mastering NIS2 compliance.
DORA Compliance Guide
Download the full DORA Compliance Guide and take control of your ICT risk management and regulatory obligations.
