Populus Financial data breach impacted more than 50,000 customers

Texas-based Populus Financial Group recently disclosed a data breach that has compromised the sensitive personal information of thousands of its customers.

Irving, Texas-based financial services company Populus Financial Group is the parent company of major brands like ACE Cash Express, ACE Elite Visa Prepaid Debit Card, ACE Flare Account by MetaBank, and Porte, a premium mobile banking platform. The company employs over 3,100 people across 80 US locations.

In a data breach filing with the office of the Attorney General of Maine, the company said that on January 14, it identified “anomalous activity associated with one of our user accounts.” Populus immediately launched an internal investigation, with assistance from external cyber security experts, to understand the scope of the security incident.

“The investigation determined that an unauthorised actor had obtained access to one of our user accounts through a sophisticated cyberattack. The unauthorised actor initially obtained access to this account on January 9, 2023, and used the account to access our cloud-based file management system and to procure files that contained your personal information,” the company said.

It said the compromised information includes name and other personal identifier, financial account number, credit and debit card number along with security code, access code, password, or PIN for the account.

To remediate the incident, the company secured its network, removed unauthorised access from the compromised account, and implemented measures to enhance the security of its systems. Populus also notified the IRS, State Tax Agencies, and law enforcement agencies about the security incident.

While the company did not share how threat actors gained access to one of the accounts, the filing with the Attorney General of Maine confirms at least 51,858 individuals were affected by the breach.

Populus is providing all impacted individuals with a complimentary 24 months of credit monitoring and identity restoration services through Experian. Impacted individuals need to enroll by June 30 to avail of the service. The company has also encouraged all its customers to remain vigilant against any suspicious activity in their accounts and report the same to relevant law enforcement authorities.