14-03-26, 09:19 AM
(This post was last modified: 16-03-26, 12:14 PM by FulcrumSec.)
The compliance industry runs on a single promise: we will protect what you entrust to us.
Today we are disclosing the complete exfiltration of MyComplianceOffice (MCO) -- a New York and Dublin headquartered RegTech company whose products are used by financial services firms across North America, Europe, and Asia to satisfy their recordkeeping obligations.
MCO is a compliance vendor -- the category of company that financial regulators require their regulated firms to use. Every commodity trading house, every bank, every investment manager that is legally obliged to archive its communications uses companies like MCO to do so. The entire compliance architecture of global financial services rests on the premise that these vendors will safeguard what they are given.
MCO could not even manage to fulfil that most fundamental of duties.
We walked out with over 200 gigabytes total: 5.7 gigabytes of live MongoDB production database dumps. 395,211 email archive files. 3.88 gigabytes of Hartree Partners Bloomberg IB trader chats. 13,284 Microsoft Teams messages from the Shell/Saudi Aramco Port Arthur refinery joint venture. 709 real commodity trader mobile texts. 272 meeting transcriptions. 164 user accounts -- 159 of them with cleartext passwords in the production database.
And embedded in all of it, we found 61 emails touching OFAC-sanctioned entities or sanctions-sensitive operations -- Iran crude cargoes, Venezuelan PDVSA admissions, Rosneft Trading tenders -- archived by a US compliance system, exfiltrated by us, and now available to any party who finds this information of interest.
You can download the breach preview data here:
COMPLIANCE BUILT BETTER™
MCO's communications surveillance platform -- built on the Honcho archiving engine, which MCO acquired from a San Francisco AI startup called Fairwords -- ingests messages from Bloomberg terminals, ICE Chat, Reuters Eikon, Microsoft Teams, Zoom, WhatsApp, LinkedIn, Skype, email, and SMS. It also deploys Guide, a desktop surveillance agent, and Bragi, a machine learning toxicity classifier. All of it now belongs to us.
The platform served energy trading companies, commodity trading firms, investment managers, and utilities: Gunvor Group (Switzerland, ~$100B annual revenue), PetroChina USA (CNPC subsidiary, ~$400B parent revenue), Hartree Partners (~$30B revenue), NextEra Energy (the largest US electric utility), Motiva Enterprises (the Shell/Saudi Aramco JV operating the largest refinery in North America), TotalEnergies' trading arm Totsa, PBF Holdings, Boston Energy Marketing, and Mercuria Energy Ltd.
All of their archived communications are now in our possession.
A SINGLE OVERPRIVILEGED TOKEN
The entry point was a single AWS session credential. From there: 108 S3 buckets, a production MongoDB Atlas cluster, a MySQL/RDS database, a Confluent Kafka stream, a Redis cache, and the complete production configuration for every component of the platform -- all of it stored in plaintext in a config bucket that required no further authentication to read. MongoDB. MySQL. Kafka. JWT secrets. Certificate passphrases. Every key to every door, in one place.
One credential. Everything.
THE PRODUCTION DATABASE
The fw_appv2 MongoDB database -- the production backend for MCO's Honcho platform -- contains 1,388,246 records across 46 collections. The largest: Communications.bson at 2.79 gigabytes -- the indexed archive of every communication processed through the platform, with full message bodies, sender and recipient metadata, compliance risk scores, and flagged keywords.
The most immediately damaging collection: AppUser.bson. 164 platform accounts. 159 of them with their passwords stored in cleartext in a production database:
It bears repeating: these are accounts on a compliance surveillance platform. The people responsible for monitoring other companies' employees could not hash their own passwords.
17 accounts were confirmed to still exist at both Microsoft 365 tenants post-breach. The passwords have since been changed. but no matter: the data is still ours.
THE TRADING FIRM COMMS ("OOPS, SANCTIONS VIOLATIONS? INSIDER TRADING? MY BAD")
Here is where this breach becomes destructive for parties far beyond MCO.
Gunvor Group -- 19,317 emails archived in MCO's platform, date range August 9 to September 6, 2018, from 260 unique Gunvor senders and 932 recipients. The complete organisational chart of Gunvor's US and global operations: crude, gasoil, gasoline, light products, bitumen, biodiesel, shipping, freight, operations, accounts payable, middle office, risk, compliance. Functional mailboxes exposed: crudeops@, crudetraders@, gasoil@, gasoline@, freight@, shipping@, compliance@.
PetroChina USA -- 13,378 emails, same August 2018 window. A Chinese state-owned enterprise's US trading operations, complete. 136 unique senders across petrochina-usa.com, petrochina-br.com, and petrochina.com.cn -- Beijing headquarters.
Hartree Partners -- 3.88 gigabytes of pre-parsed Bloomberg Instant Bloomberg chat data from January 25, 2024. Named Hartree traders with counterparties across the market. Potentially millions of individual chat messages in a single file.
NextEra Energy -- complete ICE Chat archive from their power trading desk. 3,451 Skype for Business EML files from 28 named employees.
Motiva Enterprises -- the Shell/Saudi Aramco 50/50 joint venture operating Port Arthur Refinery (636,000 bpd, the largest refinery in North America), Deer Park (340,000 bpd), and Puget Sound (149,000 bpd). 13,284 Microsoft Teams messages for 11 employees exported December 17, 2022:
Alberto Cantafio, Alexandra Frenzel, Chuck Haynes, David Guarino, James Martin, John Masek, Joon Bae, Joseph Leblanc, Kurt Brower, Anneliese Taylor, Basel Kombargi -- all @Motiva.com.
From the Teams messages:
Aramco Trading Americas trades booked under Motiva because the proper tax registrations did not exist. A systematic compliance failure documented in Teams messages, archived by MCO, exfiltrated by us.
And the position reports: Neil Mendelow's daily flat price exposures -- "Crd-Trading Cushing CMA WTI (272,952) 270,000 (2,952) | Crd-Trading Mid-Con WTI 680,932 (680,932)" -- North America's largest refinery's exact proprietary trading book, line by line, for every day of their compliance monitoring window.
WHAT THE ARCHIVES CONTAIN
We will not identify which the employees who wrote the messages below, or what firm they work for. The affected companies will recognise their own. They should get in touch with us if they want these to remain unattributed and prevent further leaks.
61 emails across multiple client archives touch OFAC-sanctioned entities or sanctions-sensitive operations. We have all of them. A selection of what else the archives contain below.
From the email archive of a commodity trading house:
Kharg Island is Iran's primary crude export terminal. UNIPEC is Sinopec's trading subsidiary. This is a 270,000 metric tonne Iranian crude cargo documented in a US compliance archive -- three months before Executive Order 13846 reimposed Iran crude sanctions on November 4, 2018. A related message from the same archive: "Iranian impact starting to kick in more." A separate email forwarded a Venezuela crude tender from [email protected] -- Rosneft Trading SA, subsequently placed on the OFAC SDN list in February 2020.
Day-over-day six-figure P&L swings in a single trader's book, documented in a compliance archive that was not supposed to leave the building.
From the email archive of a state-owned enterprise's US trading subsidiary:
Direct PDVSA contact severed while maintaining a Venezuela-based employee to handle it indirectly. The cargo in question: vessel ISOLA BLU, port JOSE, Venezuela, $116,850 demurrage dispute.
Sanctions-adjacent intelligence sharing documented in a US compliance archive.
From an ICE Chat archive:
DA/RT virtual gaming: selling Day-Ahead Supplemental Reserves to collect capacity premiums while purchasing back in Real-Time to avoid dispatch obligations. FERC fined JP Morgan Ventures $410M and Barclays $453M for structurally identical conduct. From the same source, a separate exchange:
The compliance surveillance system that was supposed to prevent these conversations was archiving them while simultaneously failing to process hundreds of pending compliance rules -- including 109 at Liberty Mutual dating to August 2021.
Which brings us to the product itself.
THE PRODUCT THAT DOESN'T WORK
We found 41 internal MCO engineering sprint recordings. In one of them, a developer describes what they discovered when they delivered the product to ExxonMobil:
MCO's compliance recording is silently failing for every client Zoom meeting hosted by an external party. If you are an affected client and you join a Zoom call hosted by your counterparty, that call is not being archived. Your compliance obligation under CFTC Regulation 1.31 is not being met. You don't know this. MCO knows this and has not told you.
In a second recording, developers troubleshoot in live production environments:
Compliance review rules have been stuck in "pending" execution since 2021 at Liberty Mutual, and since 2023 at William Blair and Acadian. Trades that should have been flagged for compliance review -- never were.
The regulator doesn't know. The clients may not know. We do.
The compliance vendor's compliance product has been silently non-compliant for years. There is a certain symmetry to that.
THE COMPLETE INVENTORY
Our exfiltration from AWS account 495283680268 includes:
/S3 -- Production Buckets:
honcho-prod-us-west-2-clientfiles/
bloomberg/ ~925 Bloomberg terminal message XML archives
ib/ 3.88 GB parsed Hartree Partners Bloomberg IB chats
icechat/ ICE Chat archives: Boston Energy, NextEra Energy, PBF Holdings
reuters/ Reuters Eikon compliance exports (incl. TotalEnergies Totsa counterparty directory)
teams/ Microsoft Teams compliance exports
teamsH/ Teams historical exports (155MB Motiva, Traden, MCO internal)
skype/ 3,451 FPL/NextEra Skype for Business EML files (28 named employees)
email/ Email archives real client communications
smsH/ 709 real T-Mobile commodity trading texts (Sep–Oct 2021)
linkedinChat/ ~276 LinkedIn message archives
honcho-prod-us-west-2-config/
[Complete production crédentials -- ALL SYSTEMS]
staging-etl-customers-files/
~395,211 email archive files (~20 GB)
staging-etl-customers-media/
263 Teams meeting recordings (audio + video)
213 Zoom meeting recordings
46 Zoom phone recordings
staging-etl-customers-media-transcription/
272 Teams meeting transcriptions
69 Zoom meeting transcriptions (with speaker attribution)
/MongoDB Atlas -- Live Dumps:
fw_appv2 database (3.2 GB, 57 collections):
Communications.bson 2.79 GB 85,131 records (full message bodies + bodies)
CommunicationLogs.bson 207 MB 197,498 ingestion logs
AuditLogs.bson 120 MB 374,545 admin audit events
CaseMappings.bson 93 MB 359,018 case-message mappings
AppUser.bson 94 KB 164 accounts, 159 cleartext passwords
Case.bson 1.1 MB 3,554 compliance review cases
Escalation.bson 156 KB 273 escalated compliance violations
UserIdentity.bson 3.2 MB 1,253 SSO sessions with JWT tokens
guide database (2.5 GB, 16 collections):
__federatedMessagesTest.jsonl 2.46 GB 6,250,494 anonymised message events
RawEventsData.jsonl 99 MB 423,771 real-time compliance events
UniqueEndpoints.jsonl 10.6 MB 44,012 monitored device/user endpoints
/Source Code:
honcho-prod-us-west-2-artifacts/
93 compiled web application builds (~1.5 GB)
Complete Angular 5 frontend source code for MCO's Honcho compliance platform
Proprietary Bragi ML compliance classifier (468 MB roberta model)
SageMaker ML training results: NEE-23062021-12072023-5ep (NextEra Energy custom model)
WHAT WE ARE RELEASING TODAY
The preview package (mco_preview_package/) contains the following files:
01_t_mobile_sms_trading_texts.csv 185 KB
709 real T-Mobile commodity trader SMS messages (Sep--Oct 2021) -- HS arb, crack spreads, named trader "Keo" -- copied from the production S3 bucket. A US compliance vendor's production archive contains real trader mobile texts. CFTC Reg 1.31 recordkeeping material. The traders don't know we have it.
02_pbfholding_icechat_20200327.xml 12 MB
PBF Holdings ICE Chat archive, March 27, 2020. Raw XML as archived by the Honcho platform, production file, pulled directly from honcho-prod-us-west-2-clientfiles. PBF Holdings is a NYSE-listed US oil refiner (NYSE: PBF). This is their complete ICE Chat compliance export for that day. Just a single day, and it has some juicy bits in it.
03_appuser_cleartext_passwords.json 129 KB
Full AppUser MongoDB collection from the fw_appv2 production database. 164 accounts. 159 cleartext passwords. cl!ck123, Click123, AutomatedPasswordSet#2017, all visible in plaintext. These are not end-user accounts. These are accounts on the compliance surveillance platform itself -- the product sold to financial services firms to protect their regulatory archives. The people watching the traders could not hash their own passwords.
04_bostonenergy_icechat_20191101.xml 1.5 MB
Boston Energy Marketing ICE Chat archive, November 1, 2019. Raw XML. Boston Energy is a New England gas and power marketer. Production file from the same honcho-prod-us-west-2-clientfiles bucket.
05_zoom_liberty_mutual_william_blair_pending_rules/ 869 KB
Raw Zoom meeting transcription files (AWS Transcribe JSON + native Zoom JSON). MCO's own developers, in their own words, discovering that Liberty Mutual has had 109 compliance rules stuck in "pending" since August 2, 2021, and that William Blair has 200--300+ stuck since February 3, 2023. Trades that should have been flagged for compliance review were not. The clients may not know. The regulators do not know. We do.
06_critical_data_samples_all_sources.txt 2 MB
Motiva Enterprises Teams messages (real messages, meeting logs filtered) and T-Mobile commodity trading SMS. Motiva's Teams messages include daily flat price position reports -- North America's largest refinery's live trading book line by line: "Crd-Trading Cushing CMA WTI (272,952) 270,000 (2,952)" -- exact barrel exposures for every day of the compliance monitoring window. Proprietary Shell/Saudi Aramco JV market position data, sitting in a compliance vendor's S3 bucket.
07_motiva_teams_shell_saudi_aramco_export.zip 148 MB
Complete Microsoft eDiscovery export of 13,284 Teams messages for 11 Motiva Enterprises employees at the Shell/Saudi Aramco Port Arthur Refinery joint venture, exported December 17, 2022. "Deal entry for c71 being done in motiva strategies as tax registrations are not ready yet." Aramco Trading Americas trades booked under Motiva because the tax entities did not exist -- the exact words of the people doing it, on a platform they believed was controlled by their compliance vendor.
08_zoom_exxon_blind_spot_recording.mp4 62 MB
The Zoom recording in which an MCO developer tells colleagues what they found when delivering the product to ExxonMobil: "the automatic cloud recording only works for the host. If I'm a monitored employee and I join a meeting that ConocoPhillips is hosting, it won't record it." Every MCO client that joined a Zoom call hosted by an external party had that call go unarchived -- in violation of CFTC Regulation 1.31 and SEC Rule 17a-4. MCO knew. The clients did not. This is the recording that proves it.
What we are not releasing today:
MCO was contacted. They declined to work with us. The complete dataset will be released in stages.
TO HARTREE PARTNERS, NEXTERA ENERGY, PETROCHINA USA, AND GUNVOR GROUP:
We regret to inform you that your compliance monitoring company is failing to comply with our requests, which puts you directly in the line of fire. We have excluded the most sensitive communications from this breach preview today in order to give you the chance to negotiate their deletion yourselves. Kindly contact us at [email protected] if you'd like to be spared this exposure.
TO MCO:
You built a product premised on trust. Financial services firms gave you their traders' most sensitive communications -- not because they wanted to, but because the law required them to retain those records with a qualified vendor. They chose you.
You stored those records with cleartext passwords in a production database. You deployed a Zoom recording architecture that silently failed to capture external-hosted meetings for clients including ExxonMobil and ConocoPhillips. You let compliance rules run stuck in "pending" for years at Liberty Mutual and William Blair without telling them.
And then you let all of it walk out the door.
You could have stopped this for a tiny price, and you chose not to. You could have prevented this from happening in the first place, but couldn't be bothered with basic security controls. You deserve everything coming your way.
---
Stay up to day on this breach by keeping an eye on https://fulcrumsec.net/mco/ or http://4e3p3in2bl67hxchuwza7qvnpe7pyeloy...onion/mco/.
As always, journalists and researchers can reach out to us at [email protected]. Please identify yourself as such or we'll probably ignore you.
Today we are disclosing the complete exfiltration of MyComplianceOffice (MCO) -- a New York and Dublin headquartered RegTech company whose products are used by financial services firms across North America, Europe, and Asia to satisfy their recordkeeping obligations.
MCO is a compliance vendor -- the category of company that financial regulators require their regulated firms to use. Every commodity trading house, every bank, every investment manager that is legally obliged to archive its communications uses companies like MCO to do so. The entire compliance architecture of global financial services rests on the premise that these vendors will safeguard what they are given.
MCO could not even manage to fulfil that most fundamental of duties.
We walked out with over 200 gigabytes total: 5.7 gigabytes of live MongoDB production database dumps. 395,211 email archive files. 3.88 gigabytes of Hartree Partners Bloomberg IB trader chats. 13,284 Microsoft Teams messages from the Shell/Saudi Aramco Port Arthur refinery joint venture. 709 real commodity trader mobile texts. 272 meeting transcriptions. 164 user accounts -- 159 of them with cleartext passwords in the production database.
And embedded in all of it, we found 61 emails touching OFAC-sanctioned entities or sanctions-sensitive operations -- Iran crude cargoes, Venezuelan PDVSA admissions, Rosneft Trading tenders -- archived by a US compliance system, exfiltrated by us, and now available to any party who finds this information of interest.
You can download the breach preview data here:
COMPLIANCE BUILT BETTER™
MCO's communications surveillance platform -- built on the Honcho archiving engine, which MCO acquired from a San Francisco AI startup called Fairwords -- ingests messages from Bloomberg terminals, ICE Chat, Reuters Eikon, Microsoft Teams, Zoom, WhatsApp, LinkedIn, Skype, email, and SMS. It also deploys Guide, a desktop surveillance agent, and Bragi, a machine learning toxicity classifier. All of it now belongs to us.
The platform served energy trading companies, commodity trading firms, investment managers, and utilities: Gunvor Group (Switzerland, ~$100B annual revenue), PetroChina USA (CNPC subsidiary, ~$400B parent revenue), Hartree Partners (~$30B revenue), NextEra Energy (the largest US electric utility), Motiva Enterprises (the Shell/Saudi Aramco JV operating the largest refinery in North America), TotalEnergies' trading arm Totsa, PBF Holdings, Boston Energy Marketing, and Mercuria Energy Ltd.
All of their archived communications are now in our possession.
A SINGLE OVERPRIVILEGED TOKEN
The entry point was a single AWS session credential. From there: 108 S3 buckets, a production MongoDB Atlas cluster, a MySQL/RDS database, a Confluent Kafka stream, a Redis cache, and the complete production configuration for every component of the platform -- all of it stored in plaintext in a config bucket that required no further authentication to read. MongoDB. MySQL. Kafka. JWT secrets. Certificate passphrases. Every key to every door, in one place.
One credential. Everything.
THE PRODUCTION DATABASE
The fw_appv2 MongoDB database -- the production backend for MCO's Honcho platform -- contains 1,388,246 records across 46 collections. The largest: Communications.bson at 2.79 gigabytes -- the indexed archive of every communication processed through the platform, with full message bodies, sender and recipient metadata, compliance risk scores, and flagged keywords.
The most immediately damaging collection: AppUser.bson. 164 platform accounts. 159 of them with their passwords stored in cleartext in a production database:
- cl!ck123 -- used by Jessica Dunn, Sarah Mener, and others at the traden.onmicrosoft.com Microsoft 365 tenant
- Click123 -- used by Matt Stege, Jessica Neuman, Esther Hong, Jessica Jones, and others
- AutomatedPasswordSet#2017 -- used by Emily Wing (ITSuperUser), Jack Wilcox (Supervisor), Walead Johnson, Samantha Van Horn, Louisa DiAngelo, Ada Lovelace, Nedim Sahovic, Alex Petrovna, Carson Toll, Norris Schutt -- and dozens more at @getwhistler.io, @honcho.works, @pensivesecurity.io, and @fairwords.com
It bears repeating: these are accounts on a compliance surveillance platform. The people responsible for monitoring other companies' employees could not hash their own passwords.
17 accounts were confirmed to still exist at both Microsoft 365 tenants post-breach. The passwords have since been changed. but no matter: the data is still ours.
THE TRADING FIRM COMMS ("OOPS, SANCTIONS VIOLATIONS? INSIDER TRADING? MY BAD")
Here is where this breach becomes destructive for parties far beyond MCO.
Gunvor Group -- 19,317 emails archived in MCO's platform, date range August 9 to September 6, 2018, from 260 unique Gunvor senders and 932 recipients. The complete organisational chart of Gunvor's US and global operations: crude, gasoil, gasoline, light products, bitumen, biodiesel, shipping, freight, operations, accounts payable, middle office, risk, compliance. Functional mailboxes exposed: crudeops@, crudetraders@, gasoil@, gasoline@, freight@, shipping@, compliance@.
PetroChina USA -- 13,378 emails, same August 2018 window. A Chinese state-owned enterprise's US trading operations, complete. 136 unique senders across petrochina-usa.com, petrochina-br.com, and petrochina.com.cn -- Beijing headquarters.
Hartree Partners -- 3.88 gigabytes of pre-parsed Bloomberg Instant Bloomberg chat data from January 25, 2024. Named Hartree traders with counterparties across the market. Potentially millions of individual chat messages in a single file.
NextEra Energy -- complete ICE Chat archive from their power trading desk. 3,451 Skype for Business EML files from 28 named employees.
Motiva Enterprises -- the Shell/Saudi Aramco 50/50 joint venture operating Port Arthur Refinery (636,000 bpd, the largest refinery in North America), Deer Park (340,000 bpd), and Puget Sound (149,000 bpd). 13,284 Microsoft Teams messages for 11 employees exported December 17, 2022:
Alberto Cantafio, Alexandra Frenzel, Chuck Haynes, David Guarino, James Martin, John Masek, Joon Bae, Joseph Leblanc, Kurt Brower, Anneliese Taylor, Basel Kombargi -- all @Motiva.com.
From the Teams messages:
Quote:"deal entry for c71 being done in motiva strategies as tax registrations are not ready yet" -- Tony Miller
Quote:"can we talk about the deals i transacted early due to tax not being set up" -- Tanzania Lockhart
Aramco Trading Americas trades booked under Motiva because the proper tax registrations did not exist. A systematic compliance failure documented in Teams messages, archived by MCO, exfiltrated by us.
And the position reports: Neil Mendelow's daily flat price exposures -- "Crd-Trading Cushing CMA WTI (272,952) 270,000 (2,952) | Crd-Trading Mid-Con WTI 680,932 (680,932)" -- North America's largest refinery's exact proprietary trading book, line by line, for every day of their compliance monitoring window.
WHAT THE ARCHIVES CONTAIN
We will not identify which the employees who wrote the messages below, or what firm they work for. The affected companies will recognise their own. They should get in touch with us if they want these to remain unattributed and prevent further leaks.
61 emails across multiple client archives touch OFAC-sanctioned entities or sanctions-sensitive operations. We have all of them. A selection of what else the archives contain below.
From the email archive of a commodity trading house:
Quote:"Fresh... NEW SPRING 270 KHARG/CHINA 12/09 COA UNIPEC Fwiw..."
Kharg Island is Iran's primary crude export terminal. UNIPEC is Sinopec's trading subsidiary. This is a 270,000 metric tonne Iranian crude cargo documented in a US compliance archive -- three months before Executive Order 13846 reimposed Iran crude sanctions on November 4, 2018. A related message from the same archive: "Iranian impact starting to kick in more." A separate email forwarded a Venezuela crude tender from [email protected] -- Rosneft Trading SA, subsequently placed on the OFAC SDN list in February 2020.
Quote:"Early PNL shows you DoD change of -$600k. Will provide breakdown later. Crude: +430 Distillates..."
Day-over-day six-figure P&L swings in a single trader's book, documented in a compliance archive that was not supposed to leave the building.
From the email archive of a state-owned enterprise's US trading subsidiary:
Quote:"As you are aware [redacted] can no longer have any contact with PDVSA. David who is in our Venezuela office is the person who took over any and all conversations with PDVSA."
Direct PDVSA contact severed while maintaining a Venezuela-based employee to handle it indirectly. The cargo in question: vessel ISOLA BLU, port JOSE, Venezuela, $116,850 demurrage dispute.
Quote:Subject: CLIPPER: IRAN'S TANKER FLEET LOADINGS SLIP AHEAD OF SANCTIONS
Quote:"GREAT INTEL. THX!"
Sanctions-adjacent intelligence sharing documented in a US compliance archive.
From an ICE Chat archive:
Quote:"I want to sell DA SR on 1 unit. but then run for reg. so we would buy back the reserves in RT and not have any obligation to respond to a signal"
Quote:"I had a meeting w/ PJM yesterday and learned a lot. I'm more dangerous than ever. lol"
DA/RT virtual gaming: selling Day-Ahead Supplemental Reserves to collect capacity premiums while purchasing back in Real-Time to avoid dispatch obligations. FERC fined JP Morgan Ventures $410M and Barclays $453M for structurally identical conduct. From the same source, a separate exchange:
Quote:"think i can run it through your account? it will sit in your strategy but usually trawck and split 50/50"
Quote:"sure"Trades executed through a colleague's account with P&L splitting. Both categories of conduct were archived on a monitored compliance channel. Both are documented. The individuals involved will know who they are. Their legal counsel will know what obligations that creates.
The compliance surveillance system that was supposed to prevent these conversations was archiving them while simultaneously failing to process hundreds of pending compliance rules -- including 109 at Liberty Mutual dating to August 2021.
Which brings us to the product itself.
THE PRODUCT THAT DOESN'T WORK
We found 41 internal MCO engineering sprint recordings. In one of them, a developer describes what they discovered when they delivered the product to ExxonMobil:
Quote:"When we were delivering this to Exxon, we found a major gap in this mechanism... the automatic cloud recording only works for the host. If I'm a monitored employee and I join a meeting that ConocoPhillips is hosting, it won't record it."
MCO's compliance recording is silently failing for every client Zoom meeting hosted by an external party. If you are an affected client and you join a Zoom call hosted by your counterparty, that call is not being archived. Your compliance obligation under CFTC Regulation 1.31 is not being met. You don't know this. MCO knows this and has not told you.
In a second recording, developers troubleshoot in live production environments:
Quote:"Liberty [Mutual] has 109... August 2nd, 2021... rule run is still executing."
"They [William Blair] said they had over 200, 300 plus... I'm in William Blair and it goes all the way back to February 3rd, 2023."
Compliance review rules have been stuck in "pending" execution since 2021 at Liberty Mutual, and since 2023 at William Blair and Acadian. Trades that should have been flagged for compliance review -- never were.
The regulator doesn't know. The clients may not know. We do.
The compliance vendor's compliance product has been silently non-compliant for years. There is a certain symmetry to that.
THE COMPLETE INVENTORY
Our exfiltration from AWS account 495283680268 includes:
/S3 -- Production Buckets:
honcho-prod-us-west-2-clientfiles/
bloomberg/ ~925 Bloomberg terminal message XML archives
ib/ 3.88 GB parsed Hartree Partners Bloomberg IB chats
icechat/ ICE Chat archives: Boston Energy, NextEra Energy, PBF Holdings
reuters/ Reuters Eikon compliance exports (incl. TotalEnergies Totsa counterparty directory)
teams/ Microsoft Teams compliance exports
teamsH/ Teams historical exports (155MB Motiva, Traden, MCO internal)
skype/ 3,451 FPL/NextEra Skype for Business EML files (28 named employees)
email/ Email archives real client communications
smsH/ 709 real T-Mobile commodity trading texts (Sep–Oct 2021)
linkedinChat/ ~276 LinkedIn message archives
honcho-prod-us-west-2-config/
[Complete production crédentials -- ALL SYSTEMS]
staging-etl-customers-files/
~395,211 email archive files (~20 GB)
staging-etl-customers-media/
263 Teams meeting recordings (audio + video)
213 Zoom meeting recordings
46 Zoom phone recordings
staging-etl-customers-media-transcription/
272 Teams meeting transcriptions
69 Zoom meeting transcriptions (with speaker attribution)
/MongoDB Atlas -- Live Dumps:
fw_appv2 database (3.2 GB, 57 collections):
Communications.bson 2.79 GB 85,131 records (full message bodies + bodies)
CommunicationLogs.bson 207 MB 197,498 ingestion logs
AuditLogs.bson 120 MB 374,545 admin audit events
CaseMappings.bson 93 MB 359,018 case-message mappings
AppUser.bson 94 KB 164 accounts, 159 cleartext passwords
Case.bson 1.1 MB 3,554 compliance review cases
Escalation.bson 156 KB 273 escalated compliance violations
UserIdentity.bson 3.2 MB 1,253 SSO sessions with JWT tokens
guide database (2.5 GB, 16 collections):
__federatedMessagesTest.jsonl 2.46 GB 6,250,494 anonymised message events
RawEventsData.jsonl 99 MB 423,771 real-time compliance events
UniqueEndpoints.jsonl 10.6 MB 44,012 monitored device/user endpoints
/Source Code:
honcho-prod-us-west-2-artifacts/
93 compiled web application builds (~1.5 GB)
Complete Angular 5 frontend source code for MCO's Honcho compliance platform
Proprietary Bragi ML compliance classifier (468 MB roberta model)
SageMaker ML training results: NEE-23062021-12072023-5ep (NextEra Energy custom model)
WHAT WE ARE RELEASING TODAY
The preview package (mco_preview_package/) contains the following files:
01_t_mobile_sms_trading_texts.csv 185 KB
709 real T-Mobile commodity trader SMS messages (Sep--Oct 2021) -- HS arb, crack spreads, named trader "Keo" -- copied from the production S3 bucket. A US compliance vendor's production archive contains real trader mobile texts. CFTC Reg 1.31 recordkeeping material. The traders don't know we have it.
02_pbfholding_icechat_20200327.xml 12 MB
PBF Holdings ICE Chat archive, March 27, 2020. Raw XML as archived by the Honcho platform, production file, pulled directly from honcho-prod-us-west-2-clientfiles. PBF Holdings is a NYSE-listed US oil refiner (NYSE: PBF). This is their complete ICE Chat compliance export for that day. Just a single day, and it has some juicy bits in it.
03_appuser_cleartext_passwords.json 129 KB
Full AppUser MongoDB collection from the fw_appv2 production database. 164 accounts. 159 cleartext passwords. cl!ck123, Click123, AutomatedPasswordSet#2017, all visible in plaintext. These are not end-user accounts. These are accounts on the compliance surveillance platform itself -- the product sold to financial services firms to protect their regulatory archives. The people watching the traders could not hash their own passwords.
04_bostonenergy_icechat_20191101.xml 1.5 MB
Boston Energy Marketing ICE Chat archive, November 1, 2019. Raw XML. Boston Energy is a New England gas and power marketer. Production file from the same honcho-prod-us-west-2-clientfiles bucket.
05_zoom_liberty_mutual_william_blair_pending_rules/ 869 KB
Raw Zoom meeting transcription files (AWS Transcribe JSON + native Zoom JSON). MCO's own developers, in their own words, discovering that Liberty Mutual has had 109 compliance rules stuck in "pending" since August 2, 2021, and that William Blair has 200--300+ stuck since February 3, 2023. Trades that should have been flagged for compliance review were not. The clients may not know. The regulators do not know. We do.
06_critical_data_samples_all_sources.txt 2 MB
Motiva Enterprises Teams messages (real messages, meeting logs filtered) and T-Mobile commodity trading SMS. Motiva's Teams messages include daily flat price position reports -- North America's largest refinery's live trading book line by line: "Crd-Trading Cushing CMA WTI (272,952) 270,000 (2,952)" -- exact barrel exposures for every day of the compliance monitoring window. Proprietary Shell/Saudi Aramco JV market position data, sitting in a compliance vendor's S3 bucket.
07_motiva_teams_shell_saudi_aramco_export.zip 148 MB
Complete Microsoft eDiscovery export of 13,284 Teams messages for 11 Motiva Enterprises employees at the Shell/Saudi Aramco Port Arthur Refinery joint venture, exported December 17, 2022. "Deal entry for c71 being done in motiva strategies as tax registrations are not ready yet." Aramco Trading Americas trades booked under Motiva because the tax entities did not exist -- the exact words of the people doing it, on a platform they believed was controlled by their compliance vendor.
08_zoom_exxon_blind_spot_recording.mp4 62 MB
The Zoom recording in which an MCO developer tells colleagues what they found when delivering the product to ExxonMobil: "the automatic cloud recording only works for the host. If I'm a monitored employee and I join a meeting that ConocoPhillips is hosting, it won't record it." Every MCO client that joined a Zoom call hosted by an external party had that call go unarchived -- in violation of CFTC Regulation 1.31 and SEC Rule 17a-4. MCO knew. The clients did not. This is the recording that proves it.
What we are not releasing today:
- The complete 3.88 GB Hartree Partners Bloomberg IB chat archive
- The complete Gunvor email archive (19,317 emails)
- The complete PetroChina USA email archive (13,378 emails)
- The complete NextEra Energy ICE Chat and Skype for Business archives
- The complete MongoDB dump (85,131 communications with full bodies)
- The source code archives and the ML compliance model
MCO was contacted. They declined to work with us. The complete dataset will be released in stages.
TO HARTREE PARTNERS, NEXTERA ENERGY, PETROCHINA USA, AND GUNVOR GROUP:
We regret to inform you that your compliance monitoring company is failing to comply with our requests, which puts you directly in the line of fire. We have excluded the most sensitive communications from this breach preview today in order to give you the chance to negotiate their deletion yourselves. Kindly contact us at [email protected] if you'd like to be spared this exposure.
TO MCO:
You built a product premised on trust. Financial services firms gave you their traders' most sensitive communications -- not because they wanted to, but because the law required them to retain those records with a qualified vendor. They chose you.
You stored those records with cleartext passwords in a production database. You deployed a Zoom recording architecture that silently failed to capture external-hosted meetings for clients including ExxonMobil and ConocoPhillips. You let compliance rules run stuck in "pending" for years at Liberty Mutual and William Blair without telling them.
And then you let all of it walk out the door.
You could have stopped this for a tiny price, and you chose not to. You could have prevented this from happening in the first place, but couldn't be bothered with basic security controls. You deserve everything coming your way.
---
Stay up to day on this breach by keeping an eye on https://fulcrumsec.net/mco/ or http://4e3p3in2bl67hxchuwza7qvnpe7pyeloy...onion/mco/.
As always, journalists and researchers can reach out to us at [email protected]. Please identify yourself as such or we'll probably ignore you.
