Iress completes investigation into cyber breach
Iress has completed its internal investigation following a cyber incident earlier this year.
The firm suffered a cyber breach on 11 May which affected the OneVue production environment containing client data after a credential within the user space was stolen.
The breach affected the OneVue managed funds administration, platform and superannuation division.
At the time, the firm said it was carrying out an internal investigation and would update the market once this had been completed.
Making a statement to the ASX on 2 July, the technology firm said it has now completed the internal investigation into the breach.
“The investigation has found no evidence of unauthorised access to Iress’ production environment, software or client data other than a limited portion of Iress’ OneVue production environment. This environment primarily contained information of a technical nature such as metadata, blank questionnaires and test files.
“Within the test files, Iress also identified a limited amount of personal information relating to 20 individuals who were employees of OneVue and its clients, and had entered their personal information for testing purposes.
“Each of these individuals has been contacted directly about the incident and provided with appropriate guidance and support. Iress has also engaged specialist cyber incident and forensic technology providers to assist in response to the incident.”
It also shed light on statements made by an alleged threat actor regarding publishing source code taken from Iress’ GitHub user space.
“Iress confirms that it does not rely on the secrecy of its code as a security measure and has continued to take steps to reinforce security controls to protect its software and systems.”
Iress completed a sale of its OneVue platform business to Praemium earlier this year, which is expected to take 18 months to migrate across to Praemium technology. This was for an initial $1 million in cash consideration and a further payment of up to an additional $20 million over an 18-month period as milestones are met.
In its own statement regarding the investigation, Praemium said: "The investigation has not identified any adverse impact on the Iress OneVue Platform business (IOPB) acquired by Praemium on 15 April 2024. This incident was first announced by Iress on 13 May 2024. On 15 May 2024, Praemium was informed that this incident may impact IOPB.
"The investigation was supported by specialist cyber incident and forensic technology providers. Praemium
is grateful for Iress’s cooperation during the period from observing the incident to its conclusion today."
Last month, Money Management wrote how ASX-listed businesses, including Iress, are required to report cybersecurity incidents to the market. These cover the four R’s of readiness, response, recovery and remediation.
Failure to promptly notify of a data breach is a breach of ASX listing rules and could have serious legal consequences for contravening the Corporations Act.
AUTHOR
Laura Dew
Recommended for you
Financial software provider Bravura has extended the term of its chief commercial officer as it seeks to finalise work on its transformation program.
Financial advice software provider DASH has partnered with HealthyMe Digital to launch a new solution for advisers and clients providing health and wellbeing content.
Research house Genium Investment Partners has made a third appointment from Morningstar in less than a year to work in its newly-launched research ratings division.
Iress has announced it is strengthening its security settings after suffering an unauthorised access of its systems over the weekend.
Add new comment