What happened
In April–May 2024 a group calling itself EMBARGO claimed responsibility for an attack on the non-bank lender Firstmac (30 April) and published data it said was stolen (8–9 May) [fm-cyberdaily], [fm-bleeping]. It is unclear from reporting whether the group breached Firstmac itself or obtained the data another way [fm-bleeping]. Firstmac then notified customers of a data breach. Its notification confirmed that names, dates of birth, addresses, email addresses and phone numbers, as well as external bank account details (BSB and account number) and driver licence numbers, had been compromised [fm-bitdefender], [fm-bleeping].
Timeline
- 2024-04-30 — EMBARGO claimed responsibility on its leak site [fm-cyberdaily], [fm-bleeping].
- 2024-05-08 — EMBARGO published data it said was taken from Firstmac (8–9 May) [fm-cyberdaily], [fm-bleeping].
- 2024-05-11 — Firstmac issued a statement saying it was working with relevant authorities [fm-cyberdaily-stmt].
- 2024-05 — Firstmac notified affected customers [fm-bitdefender], [fm-bleeping].
Current status
Disclosed. Firstmac did not publish a count of affected individuals, so no figure is asserted here. The volume of leaked data claimed by the group is not a reliable measure of how many people were affected [fm-cyberdaily].
Why it matters
A lender holds exactly the identity and banking data that enables fraud — names, dates of birth, and account details together. Publication of that data by an extortion group raises the risk for those affected.