British estate agency Foxtons Group suffered a major data breach in October last year, enabling hackers to steal vast amounts of personal and financial information before uploading them on dark web forums.
The massive data breach forced the Foxtons Group to temporarity shut down its customer portal, MyFoxtons. While Foxtons claimed that no sensitive data was compromised as a result of the attack, its employees were reportedly unable to access customer and landlord contact details on company systems. The agency later confirmed that Alexander Hall, its mortgage broking business, was affected by the data breach.
“Foxtons has been subject to a limited malware virus on a small part of the business. It appears many other businesses and organisations have been affected and this was not a targeted attack on Foxtons. We have effective systems in place and took quick action to contain the incident and minimise disruption to our customers. Current investigations reveal no sensitive data has been compromised,” the group said.
“Some IT systems were affected for several days but were restored without significant disruption to customers. All necessary disclosures have been made and full details of the attack were provided to the FCA and ICO at the time. We are satisfied that the attack did not result in the loss of any data that could be damaging to customers and believe that the FCA and ICO are satisfied with our response,” it added.
Despite the agency's claims, iNews reported that as per a recent investigation, more than 16,000 card details, addresses, and private messages, which were stolen from Foxtons' systems, were uploaded on the dark web three months ago and have been viewed for more than 15,000 times.
The report revealed that the stolen data records were collected from customers prior to 2010 and almost 20% of the leaked debit cards with full card numbers and personal information are still active. The data was uploaded on the dark web just two days after Foxtons Group's systems were targeted.
The London-based estate agency was notified about the data exposure in January this year but reportedly failed to inform the potential victims or authorities. Cyber security experts told iNews that it is possible that hackers may have only uploaded pre-2010 details for free and could be selling more recent data to the highest bidders on dark web marketplaces.
Commenting on the massive breach suffered by Foxtons, Stephen Kapp, CTO of Cortex Insight, told TEISS that it is safe to assume the worst and Foxton customers should look to protect themselves from identity fraud and card fraud as a result of this breach.
"With both personal information and payment card information lost, Foxtons customers should take some time to validate payments and potential credit history interactions since October and flag anything suspicious to their bank. Even though a subset of the entire customer data has been leaked with the attackers claiming they have the entire data and they have released only 1% publicly, it doesn’t mean it hasn’t been shared and exploited privately," he added.
According to Sam Curry, chief security officer at Cybereason, the latest episode is a sobering reminder that cyber criminals are stealing sensitive data from consumers on a daily basis and yielding massive profits by selling the information on the dark web.
"To Foxton, I encourage more transparency and hope they will further come clean on what happened and disclose the preventive measures they are taking to tighten security and limit further exposure of sensitive information.
"It is clearly no laughing matter to Foxton's customers and they are looking for reassurance that their credit card numbers and other personal information aren't part of an extortion campaign against Foxton. My advice to Foxton's customers is to pay close attention to their bank statements and if anything looks suspicious to immediately contact their credit card company. They should also be offered free credit monitoring services for at least the next year by Foxton," he added.