Newsletter #1 · Security & AI
FileMaker security: what happened, what we’re doing, what you can do
At 1-more-thing / fmcloud.fm, we work every day so you can rely on your FileMaker solutions with complete confidence. That means opening up new possibilities, particularly through artificial intelligence, but also doing essential work behind the scenes: keeping your hosting secure.
Recent events give us a good reason to talk about both—and to launch this newsletter, which many of you have asked for. (You’ll find the sign-up button at the end of this page.)
In the news
An attack campaign affecting the entire FileMaker community
In late October, an automated attack campaign targeted FileMaker servers worldwide, both hosted and on premises. Claris notified its customers about it. Servers on our fmcloud.fm platform were also targeted.
These attacks do not rely on a sophisticated exploit or a technical vulnerability in FileMaker itself. They automatically test FileMaker server endpoints (Data API, OData, Admin Console) at scale, looking for doors left open: a Guest account with API access, a weak or default password, or automatic login credentials saved in a file.
Where a file’s configuration was too permissive, the attacker was able to read data. This happened with some files hosted on our platform, and we have individually notified every affected customer. Where the configuration was strict, the attacker obtained nothing.
The lesson applies to everyone: much of a FileMaker server’s security depends on how each file is configured.
Why we were only marginally affected
● Proactive guidance from day one. When a customer deploys a server with us, they receive a confirmation email with recommendations for securing their files. We offer to handle this configuration for them and, above all, when the first files are uploaded, we check that they are properly configured. This is the main reason why so few servers could be attacked.
● A contained impact. Affected files were accessed because of their own configuration, with no impact on other customers: our architecture held up.
● Fast, detailed visibility. Logs from all our servers are centralized and monitored. This allowed us to reconstruct the attack, identify the affected files and customers, gather evidence, and provide each affected customer with specific information. This is particularly difficult on a standalone server, where logs are limited, rotate quickly, and are rarely retained or analyzed.
● A rapid response. Our alert rules flagged the suspicious activity. As soon as we identified the IP addresses used in the attack, we blocked them across all our servers through a shared, automatically distributed blocklist. This is effective, but it is not enough on its own: an attacker can switch addresses. A properly locked-down configuration remains the best defense, which is why we have included the recommendations below.
● A skilled team. The many emergency measures required—from understanding how the attack worked to taking action across the platform and on individual servers—would not have been possible without a skilled, coordinated team. Thanks to that work, we were able to maintain service without interruption in the vast majority of cases.
What we’re strengthening
✓ Already in place: a shared blocklist of malicious IP addresses, additional security alerts, and log analysis across the entire platform.
▶ In progress: an update to a third-party component we use, being rolled out gradually across our servers.
▶ In the next few days: password changes for the Admin Consoles of hosted servers.
○ Coming next: automated checks of your server and file configurations to proactively alert you to security weaknesses; stricter security rules, including a ban on Guest accounts enforced in real time; regular system updates; a formal crisis management procedure; and expanded monitoring.
We are also learning from our own handling of this incident so we can respond even faster and communicate more clearly next time.
Your next steps
What you can do today
Whether your applications are hosted with us at fmcloud.fm, with another provider, or on your own server:
Our first recommendation: take this opportunity to switch to OAuth authentication, with MFA if possible. We particularly recommend Microsoft Entra ID (formerly Azure Active Directory) or our own authentication service, fmcloud Authentication. Contact us for more information.
In your FileMaker files
See this page for file configuration guidance and our recommendations.
1. Disable the Guest account. If you truly need it, do not give it any extended privileges other than fmapp and, if necessary, fmwebdirect. In particular, remove fmrest, fmodata, and fmxml. If you are hosted on fmcloud.fm, you must notify us of any Guest account. Otherwise, we will have to close your file.
2. Use individual accounts with long, unique, hard-to-guess passwords. Replace weak or default passwords, and do not save automatic login credentials in a file.
3. Restrict privileges. Reserve Full Access for people who actually need it, and review extended privileges: a Full Access account does not need fmrest, fmodata, or fmxml if you do not use those access methods.
4. Disable unused accounts.
5. Hide your files in the sharing settings, both for FileMaker Pro (you only need to add them to your favorites once) and for WebDirect.
6. Enable encryption at rest and keep the encryption password somewhere safe, separate from your backups. This must be done locally in FileMaker Pro before uploading the file to the server. Be aware that losing this password means permanently losing the ability to open the file. Do not send us this password by email; use a secure sharing link. We can also encrypt the file for you and send you the password through a secure link.
On your server
fmcloud.fm customers: the following measures are included in the service. You do not need to take any action.
● Keep “Filter databases in client applications” enabled so users can only see files they have access to.
● Keep FileMaker Server, client software, and operating systems up to date, checking compatibility with your solutions. If your solution is older and you have not reviewed its security in a long time, keep in mind that new options have been introduced in almost every FileMaker release. Now is the time to review your file configurations.
● Use a valid SSL certificate and encrypted connections.
● Limit administrative access and network-exposed services to what is strictly necessary, using a username that is not easy to guess (not “admin”) and a long, complex password. fmcloud.fm customers: if you would like to restrict Admin Console access to your own IP addresses, contact us. We can set this up on request.
● Schedule regular, encrypted, off-site backups, and test the restore process: having a backup and knowing you can recover from it are two different things.
● If you run your own server, review its logs for failed login attempts, Guest account logins, and unusual requests to the Data API and Admin Console. If you notice anything unusual—or do not have enough log history to check—now is a good time to set up log retention and analysis. We can help.
“I have a copy on my computer”: beware of a false sense of security
Keeping a recent copy of your files outside the server is good practice, provided that copy is also protected. Every additional copy—on a laptop, an external drive, or in a synced folder—is another location to secure. It can be stolen, copied, or affected by ransomware. A copy accessible with the same credentials as your working files can be compromised at the same time. The assumption that something is secure simply because it is stored locally deserves to be questioned.
The right question is: are your backups encrypted, isolated, stored off site, and actually recoverable?
And now, AI
On a more exciting note… how about a little more AI?
Claris has announced that agentic development for FileMaker is coming soon, and we are preparing some pretty impressive new features of our own. Follow us for updates on these developments, which are fundamentally changing how applications are built.
To keep up with our upcoming announcements, subscribe to our newsletter.
And if reading this has prompted you to check the security of your FileMaker setup, contact us. We will help you identify what to review first.
