Iress completes investigation into cyber breach
Iress has completed its internal investigation following a cyber incident earlier this year.
The firm suffered a cyber breach on 11 May which affected the OneVue production environment containing client data after a credential within the user space was stolen.
The breach affected the OneVue managed funds administration, platform and superannuation division.
At the time, the firm said it was carrying out an internal investigation and would update the market once this had been completed.
Making a statement to the ASX on 2 July, the technology firm said it has now completed the internal investigation into the breach.
“The investigation has found no evidence of unauthorised access to Iress’ production environment, software or client data other than a limited portion of Iress’ OneVue production environment. This environment primarily contained information of a technical nature such as metadata, blank questionnaires and test files.
“Within the test files, Iress also identified a limited amount of personal information relating to 20 individuals who were employees of OneVue and its clients, and had entered their personal information for testing purposes.
“Each of these individuals has been contacted directly about the incident and provided with appropriate guidance and support. Iress has also engaged specialist cyber incident and forensic technology providers to assist in response to the incident.”
It also shed light on statements made by an alleged threat actor regarding publishing source code taken from Iress’ GitHub user space.
“Iress confirms that it does not rely on the secrecy of its code as a security measure and has continued to take steps to reinforce security controls to protect its software and systems.”
Iress completed a sale of its OneVue platform business to Praemium earlier this year, which is expected to take 18 months to migrate across to Praemium technology. This was for an initial $1 million in cash consideration and a further payment of up to an additional $20 million over an 18-month period as milestones are met.
In its own statement regarding the investigation, Praemium said: “The investigation has not identified any adverse impact on the Iress OneVue Platform Business (IOPB) acquired by Praemium on 15 April 2024. This incident was first announced by Iress on 13 May 2024. On 15 May 2024, Praemium was informed that this incident may impact IOPB.
“The investigation was supported by specialist cyber incident and forensic technology providers. Praemium
is grateful for Iress’ cooperation during the period from observing the incident to its conclusion today.”
Last month, Money Management wrote about how ASX-listed businesses, including Iress, are required to report cyber security incidents to the market. These cover the four R’s of readiness, response, recovery, and remediation.
Failure to promptly notify of a data breach is a breach of ASX listing rules and could have serious legal consequences for contravening the Corporations Act.
AUTHOR
Laura Dew
Recommended for you
AMP non-executive director Kathleen Bailey-Lord and Iress non-executive director Susan Forrester have been appointed to the national board of the Australian Institute of Company Directors.
Wealth manager JBWere has announced the launch of two fixed income strategies for wholesale clients, backed by UBS Asset Management.
Firetrail Investments has confirmed the departure of four executives over the last quarter, including head of investment strategy Anthony Doyle.
Ares Management has announced a new offering aimed at providing Australian wholesale clients, investors access to its private equity investment strategies, anchored in secondary investments.
TEST - working?
test.