Hackers exploited GoAnywhere vulnerability to access Mackenzie Investments' data

Toronto-based Mackenzie Investments suffered a data breach after one of its third-party vendors, InvestorCOM Inc., was hit by a cyber attack.

According to CTV News Toronto, InvestorCOM, which offers regulatory compliance software to businesses, notified Mackenzie about the security incident on March 28. Mackenzie started notifying all affected clients on April 27 about the data breach that compromised sensitive personal information like clients’ names, social insurance numbers, personal addresses, and account numbers.

“For clarity, financial information, such as client holdings and account balances, was not exposed in the incident. It is also important to note that investors’ holdings in Mackenzie funds were not impacted and our systems have not been compromised,” reads the letter sent by Mackenzie Investments to affected clients.

“After receiving notice from InvestorCOM, we took immediate steps to begin a full forensic investigation. Through our investigation, we recently discovered some personal information of current and some former investors was part of this incident,” a Mackenzie spokesperson said.
 
Mackenzie is offering all impacted individuals with complimentary credit monitoring and identity theft protection services, fraud victim assistance, and identity theft insurance.

“Mackenzie takes privacy and data protection very seriously and we are committed to protecting the confidentiality of all personal information. We greatly regret any concern or inconvenience this incident may cause to our valued clients,” the spokesperson added.

InvestorCOM said in a separate statement that it “recently became aware of a cybersecurity incident involving unauthorised access to the company’s systems related to GoAnywhere, the third-party software used for secure data transfers.”

Immediately after identifying the security breach, the company launched an investigation, with assistance from third-party cyber security experts, to understand the scope of the security incident. Also, it took necessary steps to address and contain the incident.

“Our systems are secure and have at all times remained operational and we continue to offer services to our clients,” InvestorCOM specified.

The investigation concluded that certain personal information associated with a limited number of individuals was compromised. However, the incident did not have any impact on the company’s remaining systems, apart from the SFTP system which hosted the GoAnywhere application.

Earlier this year, the notorious Clop ransomware gang exploited a zero-day vulnerability in Fortra’s GoAnywhere MFT file transfer application and victimised at least 130 organisations worldwide. The affected companies include global industry giants like California-based fintech company Hatch Bank, Australia’s largest gaming and entertainment group Crown Resorts, luxury brand retailer Saks Fifth Avenue, Japanese tech giant Hitachi, and many others.