# The transfer box was not the platform

2026-09-29

FTAPI told heise that ransomware landed on one internal server it found on 14 September. The customer transfer platform, and the files customers sent through it, are the part the company says was not touched.

Canonical: https://www.fabiocti.com/notes/the-transfer-box-was-not-the-platform/
Author: Fabio Correia

The Gentlemen listed a company whose product is other people’s files. FTAPI’s answer, given to heise today, is narrower than that listing.

The Munich firm said it detected an incident on 14 September. Someone reached a single locally run internal server and put ransomware on it. FTAPI isolated that box, brought in outside forensics, told customers and partners once it had a first reliable picture, met the reporting duties it named, and filed a criminal complaint. It says the FTAPI platform, the customers’ own systems, and the data customers exchange through the service were not affected. It says the look at customer systems is already finished, with no sign those systems were compromised, and that its own operations never stopped. Further forensics on the rest is still open. It has not said whether the door was a flaw or a stolen login.

The listing is a claim that a file-transfer vendor was breached. The confirmation is one internal server and a ransomware binary. Those are not the same sentence, and the second one does not prove the first one empty.

## What “the platform is fine” does not close

A gateway that is up is evidence about the path customers use today. It is not evidence about what sat on the internal server before it was isolated, or about whether that server could see a queue, a support dump, or a key the platform uses. “No indication” after a completed look at customer systems is a scope statement. It is not a finding that nothing was copied from the box that did get encrypted.

If you are a customer, the question is not whether the homepage loads. It is whether any file you sent, or any admin credential that could fetch one, lived on the server they have actually described. If you are the vendor’s counsel, do not brief the leak-site countdown as the inventory, and do not brief “operations unrestricted” as “no object exists.”

The product being fine is the part they were able to say. The server is the part they are still in.