Finsure 2024 Data Breach

About Finsure

Finsure is one of Australia's largest mortgage-broking aggregators, providing a network of brokers with lending panels, compliance, technology and marketing support to originate home and commercial loans. Headquartered in Sydney, it supports thousands of brokers serving borrowers across Australia.

Why They Hold Your Data

As a mortgage aggregator, Finsure and its broker network hold borrower and broker records including names, email addresses, phone numbers and physical addresses; this incident involved marketing contact data held in a third-party real-estate marketing platform rather than core lending systems.

Recent Developments

In October 2024 nearly 300,000 email addresses linked to Finsure were exposed via the third-party ActivePipe real-estate marketing platform and indexed by Have I Been Pwned. Finsure said no passwords or financial data were exposed and disputed that the data (described as largely public) constituted a notifiable breach.

Data Points Exposed

Breach Impact

As a supply-chain (vendor) exposure, the incident affects brokers and customers via a marketing platform rather than Finsure's lending systems, limiting sensitivity but still enabling contact-based fraud and creating reputational and disclosure debate. It illustrates third-party marketing-tool risk in financial services.

Exploitation & Downstream Threats

• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).