BlackRock leaks personal data of thousands of clients

Fears over the data, which could have been available for more than a month, being used in future phishing campaigns

Data

The investment management firm BlackRock accidentally made the personal details of thousands of its clients publicly-available for more than a month, including their names and email addresses.

The personal data leak manifested as links to three separate spreadsheet documents via the firm's website, each containing the names, email addresses and assets in the iShares exchange-traded funds (ETF) investment portfolio scheme.

Advertisement - Article continues below

The spreadsheet links were dated to 5 December 2018, according to Bloomberg reporters who saw the documents, and were taken down on Friday after BlackRock was notified of the leak. It is not confirmed whether the data was publicly-available throughout this period.

The documents also categorised clients by their status, with some labelled "dabblers" and "power users", while another column denoted their club level status such as "directors club" or "patriots club".

IT Pro approached BlackRock for comment but did not get a response at the time of writing. A spokesperson told Bloomberg the firm is conducting "a full review of the matter".

"The inadvertent and temporary posting of the information relates to two distribution partners serving independent advisers and does not include any of their underlying client information," the spokesperson continued.

The financial sector, particularly firms such as BlackRock and JP Morgan Chase, have proved a lucrative target for cyber criminals. The latter, for example, was targeted in a massive attack in 2014, with the details of 76 million US households and 7 million SMBs stolen.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Malwarebytes' lead malware intelligence analyst Chris Boyd told IT Pro at the time that such data could serve as a "spammer's goldmine" and could be used to conduct a series of future attacks on victims.

"The data... could be used over a long period of time to drip-feed potential victims with phishing, cold calling or targeted malware attacks via email," he explained.

There are concerns the BlackRock leak discovered this weekend may similarly put those whose details were exposed at risk of future phishing attacks by a host of groups targeting businesses across all sectors.

The Nigerian-based cyber gang known as 'London Blue' for example was in December found to have infiltrated the UK as part of a wider campaign to target chief financial officers (CFOs) across a range of businesses.

They generated a list of more than 50,000 high profile targets during a five-month period this year for purposes of future business email compromise (BEC) phishing campaigns.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now
Advertisement

Recommended

Visit/mobile/mobile-security/355889/parachute-introduces-superlock-feature
mobile security

Parachute's Superlock feature keeps your phone recording in an emergency

2 Jun 2020
Visit/security/encryption/355820/k2view-innovates-in-data-management-with-new-encryption-patent
encryption

K2View innovates in data management with new encryption patent

28 May 2020
Visit/software/video-conferencing/355410/zoom-50-adds-256-bit-encryption-and-ui-refresh
video conferencing

Zoom 5.0 adds 256-bit encryption to address security concerns

23 Apr 2020
Visit/security/hacking/355382/whatsapps-flaw-shoulder-surfing
hacking

WhatsApp flaw leaves users open to 'shoulder surfing' attacks

21 Apr 2020

Most Popular

Visit/operating-systems/ios/355935/apple-confirms-serious-bugs-in-ios-135
iOS

Apple confirms serious bugs in iOS 13.5

4 Jun 2020
Visit/mobile/5g/355911/the-uk-pivots-to-japan-for-5g-equipment
5G

The UK looks to Japan and South Korea for 5G equipment

4 Jun 2020
Visit/security/ransomware/355945/new-ransomware-uses-java-to-target-software-organisations
ransomware

Tycoon ransomware discovered using Java image files to target software firms

5 Jun 2020