Forex broker FBS leaves millions of customer records exposed

Data includes names, passwords, emails, passport numbers, credit cards, financial transactions, and more

Foreign currency symbols on a screen

Security researchers have discovered a data breach at a major foreign exchange (forex) broker.

According to WizCase, online forex trading site FBS left nearly 20 TB of data exposed on an unsecured ElasticSearch server containing over 16 billion records.

The broker had over 16 million traders on its platform spanning 190 countries. According to WizCase web security expert Chase Williams the data contained millions of confidential records, including names, passwords, email addresses, passport numbers, national IDs, credit cards, financial transactions, and more.

There were also files uploaded by users for verification, including personal photos, national ID cards, drivers’ licenses, birth certificates, bank account statements, utility bills, and unredacted credit cards. Among the blog’s redacted pictures were French and Swedish credit cards, a Portuguese password, and details of a $500,000 transaction.

A team of white hat hackers led by Ata Hakcil of WizCase discovered the ElasticSearch server. The team discovered the leak on October 1 and contacted FBS the next day. FBS secured the server on October 5. It’s unknown how long FBS left the server unprotected before that. 

“Despite containing very sensitive financial data, the server was left open without any password protection or encryption. The WizCase team found that the FBS information was accessible to anyone. The breach is a danger to both FBS and its customers. User information on online trading platforms should be well secured to prevent similar data leaks,” said Williams.

Williams added that hackers could use the personally identifiable information (PII) exposed by the leak in fraudulent authentication across other platforms. Threat actors can also use the leaked information to launch scams, phishing, and malware attacks against FBS users. 

“The data could be the basis for establishing trust to encourage clicks, malware downloads, and the availing of more confidential information. Armed with the sensitive authentic data, a cybercriminal will sound more credible when they request for information over the phone or email,” Williams said.

WizCase urged users to change their passwords, use two-factor authentication on the platform, and watch for unusual and fraudulent activity on financial statements. Experts also advise FBS customers not to share any personal confidential information requested over email or the phone by potential scammers.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

29 Jul 2021
Study finds companies are mishandling cyber security recruitment
cyber security

Study finds companies are mishandling cyber security recruitment

28 Jul 2021
What is the Computer Misuse Act?
Policy & legislation

What is the Computer Misuse Act?

28 Jul 2021
Google launches new bug bounty platform
ethical hacking

Google launches new bug bounty platform

28 Jul 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
IT Pro Panel: Why IT leaders need soft skills
professional development

IT Pro Panel: Why IT leaders need soft skills

26 Jul 2021