Fidelity Investments reports data breach exposing personal data of 77K customers
Learn More
Fidelity Investments is reporting a data breach that exposed personal information of 77,099 customers between August 17 and 19, 2024. The Boston-based financial services company discovered the unauthorized activity on August 19, when a third party accessed sensitive data through two newly created customer accounts.
The attack was executed using two customer accounts established by the attackers, which enabled access to a broader set of customer data through fraudulent requests. Details on how these accounts facilitated the broader data access remain unclear, but it seems that an IDOR vulnerability is quite probable.
An IDOR (Insecure Direct Object Reference) flaw occurs when an application allows a user to access objects (like database records or files) directly by providing an identifier (e.g., a URL parameter) without proper access control, allowing attackers to manipulate the identifier to access unauthorized dat
The company responded by terminating the unauthorized access and launching an investigation with the help of external cybersecurity experts.
The exposed data includes:
- Social Security numbers
- driver’s license information
- names and surnames
Fidelity claims that no access was gained to customers' investment accounts or funds during the incident. Fidelity is offering two years of free credit monitoring and identity restoration services through TransUnion for affected individuals, urging them to stay vigilant against potential identity theft.
