Forex broker FBS leaves millions of customer records exposed

Data includes names, passwords, emails, passport numbers, credit cards, financial transactions, and more

Foreign currency symbols on a screen

Security researchers have discovered a data breach at a major foreign exchange (forex) broker.

According to WizCase, online forex trading site FBS left nearly 20 TB of data exposed on an unsecured ElasticSearch server containing over 16 billion records.

The broker had over 16 million traders on its platform spanning 190 countries. According to WizCase web security expert Chase Williams the data contained millions of confidential records, including names, passwords, email addresses, passport numbers, national IDs, credit cards, financial transactions, and more.

There were also files uploaded by users for verification, including personal photos, national ID cards, drivers’ licenses, birth certificates, bank account statements, utility bills, and unredacted credit cards. Among the blog’s redacted pictures were French and Swedish credit cards, a Portuguese password, and details of a $500,000 transaction.

A team of white hat hackers led by Ata Hakcil of WizCase discovered the ElasticSearch server. The team discovered the leak on October 1 and contacted FBS the next day. FBS secured the server on October 5. It’s unknown how long FBS left the server unprotected before that. 

“Despite containing very sensitive financial data, the server was left open without any password protection or encryption. The WizCase team found that the FBS information was accessible to anyone. The breach is a danger to both FBS and its customers. User information on online trading platforms should be well secured to prevent similar data leaks,” said Williams.

Williams added that hackers could use the personally identifiable information (PII) exposed by the leak in fraudulent authentication across other platforms. Threat actors can also use the leaked information to launch scams, phishing, and malware attacks against FBS users. 

“The data could be the basis for establishing trust to encourage clicks, malware downloads, and the availing of more confidential information. Armed with the sensitive authentic data, a cybercriminal will sound more credible when they request for information over the phone or email,” Williams said.

WizCase urged users to change their passwords, use two-factor authentication on the platform, and watch for unusual and fraudulent activity on financial statements. Experts also advise FBS customers not to share any personal confidential information requested over email or the phone by potential scammers.

Featured Resources

BCDR buyer's guide for MSPs

How to choose a business continuity and disaster recovery solution

Download now

The definitive guide to IT security

Protecting your MSP and your customers

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Recommended

Defense Dept. expands vulnerability disclosure program to all publicly accessible defense systems
ethical hacking

Defense Dept. expands vulnerability disclosure program to all publicly accessible defense systems

5 May 2021
Security researchers take control of a Tesla via drone
ethical hacking

Security researchers take control of a Tesla via drone

5 May 2021
Best free malware removal tools 2021
Security

Best free malware removal tools 2021

5 May 2021
Acuant acquires identity verification provider Hello Soda
mergers and acquisitions

Acuant acquires identity verification provider Hello Soda

4 May 2021

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021
Dell patches vulnerability affecting hundreds of computer models worldwide
cyber security

Dell patches vulnerability affecting hundreds of computer models worldwide

5 May 2021