What happened
In late 2024 the mortgage aggregator Finsure confirmed a cyber incident affecting customers and brokers. Finsure said marketing data held on a third-party platform, which it did not name, was accessed by a cyber security researcher using compromised credentials [fin-adviser]. Finsure said the data was limited to names, email addresses, phone numbers and physical addresses, and that no credit-card details, identity documents, passwords or financial information were involved [fin-adviser].
Have I Been Pwned and media reports named the email-marketing platform ActivePipe as the alleged source. ActivePipe disputes this and says its platform was not breached [fin-adviser].
Timeline
- 2024-10 — Have I Been Pwned lists the breach date as 15 October 2024 [fin-adviser].
- 2024-11 — Finsure confirmed the incident and sent precautionary notifications to a small number of brokers and customers [fin-adviser].
Current status
Disclosed. Finsure said the incident was not a notifiable data breach because the data was largely publicly available [fin-adviser]; no regulator involvement has been reported. The number of people affected is disputed: Have I Been Pwned lists 296,124 email addresses, while ActivePipe said only 35 contacts required precautionary communication [fin-hibp], [fin-adviser]. Because there is no official count, no figure is asserted here.
Why it matters
Even a “contact details only” exposure at a mortgage aggregator is useful to fraudsters for targeted phishing, and it shows how data held on a supplier’s marketing platform sits outside a financial firm’s own systems.