FSCL reports email breach

A “malicious third party” has gained access to Financial Services Complaints Ltd (FSCL)’s email database and sent phishing emails to complainants.

Friday, May 8th 2020, 9:00AM

Susan Taylor

Chief executive Susan Taylor said the emails to a case manager were accessed and used to send “spoofed” emails to a few consumers, asking them to click a link that asked for a username and password, in an attempt to gain personal information.

She said, because the emails included information about the complaint the consumer had made, they appeared authentic. They did not come from an FSCL email address but were faked to look as though they did.

“We know that the third party accessed emails between an FSCL case manager and two consumers.

“Based on the way the third party used these emails, we suspect that they only accessed a few chains of emails, and did not access any attachments. It’s unlikely that they accessed your information. However, because of the way the data was accessed, we can’t confirm this.”

She said FSCL’s external IT provider has carried out an investigation to try to find out how the breach occurred.

It seemed that the attack had happened because the staff member’s password had been guessed, perhaps because it had been used on another site.

“Armed with a customer’s name and password, the third party then searched for a customer’s email address and has found the staff member’s work email address. Our staff members’ email addresses are published on our website. Unfortunately, this is not an uncommon occurrence more widely in business and highlights the importance of using unique passwords on different accounts.

“We are confident we have excellent security systems, but are having all staff members change their passwords and reminding them to choose a password that is unique to their work, ie not a password they use anywhere else. We are also going to institute two-factor authentication as soon as we can.”

Tags: FSCL scam security