Iress completes investigation into cyber breach
Iress has completed its internal investigation following a cyber incident earlier this year.
The firm suffered a cyber breach on 11 May which affected the OneVue production environment containing client data after a credential within the user space was stolen.
The breach affected the OneVue managed funds administration, platform and superannuation division.
At the time, the firm said it was carrying out an internal investigation and would update the market once this had been completed.
Making a statement to the ASX on 2 July, the technology firm said it has now completed the internal investigation into the breach.
“The investigation has found no evidence of unauthorised access to Iress’ production environment, software or client data other than a limited portion of Iress’ OneVue production environment. This environment primarily contained information of a technical nature such as metadata, blank questionnaires and test files.
“Within the test files, Iress also identified a limited amount of personal information relating to 20 individuals who were employees of OneVue and its clients, and had entered their personal information for testing purposes.
“Each of these individuals has been contacted directly about the incident and provided with appropriate guidance and support. Iress has also engaged specialist cyber incident and forensic technology providers to assist in response to the incident.”
It also shed light on statements made by an alleged threat actor regarding publishing source code taken from Iress’ GitHub user space.
“Iress confirms that it does not rely on the secrecy of its code as a security measure and has continued to take steps to reinforce security controls to protect its software and systems.”
Iress completed a sale of its OneVue platform business to Praemium earlier this year, which is expected to take 18 months to migrate across to Praemium technology. This was for an initial $1 million in cash consideration and a further payment of up to an additional $20 million over an 18-month period as milestones are met.
In its own statement regarding the investigation, Praemium said: “The investigation has not identified any adverse impact on the Iress OneVue Platform Business (IOPB) acquired by Praemium on 15 April 2024. This incident was first announced by Iress on 13 May 2024. On 15 May 2024, Praemium was informed that this incident may impact IOPB.
“The investigation was supported by specialist cyber incident and forensic technology providers. Praemium
is grateful for Iress’ cooperation during the period from observing the incident to its conclusion today.”
Last month, Money Management wrote about how ASX-listed businesses, including Iress, are required to report cyber security incidents to the market. These cover the four R’s of readiness, response, recovery, and remediation.
Failure to promptly notify of a data breach is a breach of ASX listing rules and could have serious legal consequences for contravening the Corporations Act.
AUTHOR
Laura Dew
Recommended for you
Iress has announced it will divest its superannuation business as the latest step in its transformation program, allowing it to focus on wealth management.
The corporate regulator has named its new chief executive, who is set to replace retiring interim CEO Greg Yanco in March.
Following the departure of its chief marketing officer last year, AMP has appointed a successor to take up the position with the appointment coming from the US.
The Financial Services Council has appointed Justine Earl-Smith as executive director for commercial partnerships and growth, a newly created role for the organisation.
TEST - working?
test.