UOB KayHian

Summary

A Malaysian online stock brokerage firm experienced a cyberattack by DESORDEN GROUP, resulting in the exfiltration of approximately 160,000 customer records containing sensitive personal information such as full names, identification numbers, passport details, contact information, and dealer or back office user data. The attackers claimed they focused solely on data extraction without disrupting the firm's systems. Despite being notified of the breach, the targeted entity did not respond to communications from the threat actor or external inquiries regarding mitigation efforts. A security advisory posted by the firm around the time of the incident did not explicitly acknowledge the breach or confirm protective actions for affected customers.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In October 2022, Malaysian stock brokerage firm UOB KayHian experienced a cyberattack claimed by the DESORDEN GROUP. The attackers reported accessing 159,807 records containing customer and internal user data, including full names, genders, religions, birthdates, nationalities, identity card (IC) numbers, passport details, email addresses, phone numbers, and physical addresses. Additional compromised information involved dealer records and back-office user details. DESORDEN stated they focused exclusively on data extraction without attempting file encryption, deletion, or system disruption. The group contacted UOB KayHian regarding the breach but received no response despite confirming the firm had read their communications. DESORDEN publicly disclosed the incident on a hacking forum in late October, ending a period of reduced public activity by the threat actor.

UOB KayHian did not acknowledge the breach publicly or respond to inquiries from media outlet DataBreaches following DESORDEN’s disclosure. On October 18, 2022, the firm published a generic security advisory on its website titled "Notice – UTRADE Security Advisory on Safeguarding Digital Privacy *NEW*," though no direct link to the breach was confirmed. DataBreaches noted concerns that exposed credentials and personal information in the stolen data—including usernames, passwords, and contact details—could facilitate unauthorized account access or targeted phishing campaigns against customers. The lack of explicit customer notification about the breach raised questions about mitigation effectiveness, as the advisory did not reference compromised data or recommend credential changes. DESORDEN maintained possession of the exfiltrated data, with no evidence of deletion or ransom demands disclosed in available reports.

Sources

Sources available to members: 1 source.