Posted on March 26, 2021 at 4:42 PM

Millions of Customers Compromised In FBS Data Breach

A massive data breach has been discovered by WizCase security researchers at FSB, a major foreign exchange broker.

The data leak was uncovered as part of the ongoing research project by WizCase, which randomly scans for unsecured servers and contacts the owners of those servers. WizCase researchers said FBS was quickly contacted to enable them to fix the issue and avoid putting more customers at risk.

The security team stated that the broker left almost 20 TB of data exposed on an unsecured ElasticSearch server that contains more than 16 billion records.

Leaked data contains sensitive personal information

Chase Williams, web security expert at WizCase, stated that the exposed data contains millions of confidential records, which include credit card details, names, financial institutions, national IDs, passwords, password numbers, and email addresses of users.

The exposed details also contain files the users uploaded for verification, including utility bills, bank account statements, unredacted credit cards, birth certificates, drivers’ license, as well as personal photos.

Other leaked financial details from customers include equity and margin fees, interest rate, previous month’s balance, total deposits, last deposit dates, number of times deposits were made, the amount deposited, as well as transaction dates.

The researchers also said the threat actors could save the exposed data for future attacks or blackmail the victim if they find sensitive details from the user’s exposed details.

FBS has fixed the issue, but users may have been exposed

The research team discovered the data breach on October 1 last year and contacted FBS the following day. FBS issued a patch and secured the file within two weeks of the notification. However, it’s not clear how long the data remained exposed before it was discovered and reported by the WizCase cybersecurity team.

The research team discovered that anyone could have access to the data. Even though the data contains sensitive details, it was surprising it was left open without any encryption or password protection, the WizCase security team stated.

The data breach has put both FBS and its customers at high risk. Williams said it’s important to protect user information in a secured platform to prevent multiple cases of data breaches, which is devastating to the victims.

He also stated that the breach has given hackers a wide spectrum of opportunities to gain access to users’ info. If the personally identifiable information (PII) of the users is exposed, threat actors can use their details to launch malware attacks, phishing, and scams against users of the exposed platform.

Threat actors can also use the data to gain trust in their unsuspecting victims to encourage malware downloads, malware clicks, and gain access to more confidential information. When they have the exposed data, the threat actors could be more convincing since they will sound more credible with the personal details they have, Williams added.

Users advised using two-factor authentication

WizCase has directed users to change their passwords on the FBS platform to avoid being targets of any future attacks. They should also opt-in for two-factor authentication (2FA) and be vigilant when receiving emails supposedly coming from their financial institutions.

The security experts have also told customers to keep their confidential information and not share them with anyone else, especially over the phone or via email.

FBS has been in the forex market for more than a decade. As one of the most popular online trading platforms in the world, FBS now has more than 16 million traders and 400,000 partners. The broker’s app for Android iOS has been downloaded over a million times in Google Play Store. Its customers and traders cut across more than 190 countries. FBS is also an official trading partner of Spanish soccer giant FC Barcelona

The forex trading business has been booming for forex brokers ever since the start of the pandemic, as many people turned to online forex trading to gain more profit.

This means many more users had to get their trading accounts created, entrusting terabytes of confidential data to online forex trading platforms. But, unfortunately, FBS had to leave its data unsecured, which has invited threat actors.