Cyber Incident Victim: Financial Services Online
Date:
Jan 2014
Location:
Australia
Summary
A group identifying as Pakiz Cyber Squad, attributed to Pakistani hackers, breached an Australian financial services provider specializing in insurance and investments, leaking affiliate data through multiple Pastebin entries. The compromised information included usernames, full names, physical and email addresses, phone numbers, plaintext passwords, and select PayPal email addresses, impacting 527 individuals associated with the organization's affiliate portal. The company had not publicly acknowledged the incident at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In early January 2014, a hacker group identifying as Pakiz Cyber Squad claimed responsibility for breaching Financial Services Online (FSO), an Australian provider of insurance, finance, superannuation, and investment services. The attackers publicly leaked 14 Pastebin entries containing what they asserted was stolen affiliate user data from FSO's systems. The compromised information included usernames, full names, physical addresses, telephone numbers, email addresses, and unencrypted passwords. Some records additionally exposed PayPal-associated email addresses, indicating potential financial transaction linkages. Cyber War News verified the publication of 527 distinct user record sets through these Pastebin disclosures. The data appeared specifically tied to FSO's affiliate portal, as opposed to its separate broker login section, suggesting targeted access to that subsystem.
The breach exposed affiliates to credential misuse and potential financial fraud due to the plaintext password disclosures and PayPal data exposure. FSO's operational awareness remained unclear at the time of reporting, as the company had not responded to media inquiries regarding the incident's validity or their investigative actions. No details emerged about how the intrusion was detected, whether systems were secured post-breach, or if affected users received notifications. The published dataset's scope—limited to 527 affiliates—implied a constrained compromise relative to broader customer bases, though the inclusion of sensitive authentication credentials heightened risks for those impacted. The absence of confirmed containment measures or public statements from FSO left the incident's resolution status undetermined in available reporting.