Cyber Incident Victim: Australian Securities and Investment Commission
Date:
Jan 2021
Location:
Australia
Summary
Australia’s securities regulator experienced a cyber security breach affecting a server used for file transfers, including credit licence applications, where unauthorized access potentially exposed certain information. The incident was detected by the organization, which indicated that credit application forms and attachments likely remained undownloaded. The breach involved file-sharing software previously linked to a similar incident impacting a New Zealand bank, suggesting potential vulnerabilities in the shared platform.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 15, 2021, the Australian Securities and Investments Commission (ASIC) publicly disclosed a cybersecurity breach affecting a server utilized for file transfers. The compromised system handled sensitive documents, including credit licence applications and associated attachments. ASIC confirmed it became aware of the incident on the same date it was announced. While unauthorized access to the server occurred, preliminary investigations indicated that attackers may have viewed certain information stored on the system. Notably, the regulator stated there was no evidence that credit licence application forms or their attachments had been downloaded by the threat actors. The breach specifically targeted a file-sharing service employed by ASIC for document transmission, though the technical mechanism of the intrusion was not detailed in initial disclosures.
The incident drew attention due to potential parallels with a cybersecurity breach at a New Zealand bank the previous month, as reported by Reuters. Both incidents reportedly involved the same file-sharing software, though ASIC did not explicitly confirm this link. The breach raised concerns about unauthorized access to financial regulatory documents and applicant data processed through ASIC’s systems. No further technical specifics regarding attacker methodologies, data exfiltration scope, or containment measures were disclosed publicly at the time of the announcement. ASIC’s statement focused on the absence of confirmed data downloads while acknowledging the possibility of information exposure. The incident underscored vulnerabilities in third-party file-transfer solutions used by regulatory bodies to manage sensitive financial sector documentation.