I’m an EasyEquities client, and I received its notification about a cyber security incident at a third-party service provider this weekend.
That puts me in a slightly different position when writing about this story as “the people potentially affected” include me. And the question I want answered is fairly basic one: what information of mine did this provider have, and what happened to it?
EasyEquities has said its internal checks found no evidence that its own systems or those of Purple Group were compromised. It also reported no impact on account security or customers’ ability to invest as the incident concerns a service provider involved in client verification, with an investigation still under way.
Reassuring customers is a good step, as I want to know my account is secure. But it leaves another unresolved concern, which is information used to identify me could still be useful to somebody trying to scam me.
It’s difficult to feel reassured when you don’t yet know what was potentially exposed.
The reporting has developed since I recieved the email. MyBroadband’s investigation on 13 September points towards RelyComply, a South African company that provides identity-verification and compliance services.
Peregrine Capital explicitly named RelyComply in its own disclosure. RelyComply confirmed that it was investigating a cyber incident affecting customers, but did not confirm whether the EasyEquities, Bidvest Bank and Cell C Fibre notifications were connected to it.
While there is evidence of a possible connection, there’s currently no basis yet to tell every EasyEquities client exactly what happened to their records.
Peregrine’s notice listed potentially affected information including identity details, addresses and bank account details but that list cannot simply be applied to EasyEquities customers. Nor should a ransomware group’s claims about the size of a theft be treated as an established count of affected people.
For now, I know I received a notice, but I do not know whether my particular records were accessed.
What bothers me more about situations like this, is how little visibility a customer has once information moves beyond the company they signed up with.
When I deal with EasyEquities, that is the business I expect to explain what is happening. A supplier may do some of the work behind the scenes, and there can be good reasons for using specialists. Ofcourse I do not expect an investment platform to build every service itself, but I do expect it to remain my point of accountability when something goes wrong.
“Third party” explains where an incident may have originated but does very little to help a customer decide what to do next.
The difference between an exposed email address and an exposed identity document isn’t a trivial one. So is the difference between information being stored in an affected system and evidence that somebody actually accessed it. Customers need those distinctions explained clearly in ordinary language. The risk also extends far beyond somebody logging into an account.
Imagine an unexpected caller who knows your name, knows which investment platform you use and says they are following up on the incident. Those details could make the call feel credible before the person asks you to do anything suspicious.
That is just an example of the concern, not something I am claiming has happened to me. Knowing personal details should never be treated as proof that a caller represents your provider.
The advice in these notifications is sensible: be cautious about unsolicited contact, do not hand over passwords or one-time PINs, and verify requests through official channels. But customers cannot personally secure a supplier’s systems or decide how much information that supplier retains.
That work belongs with the businesses collecting and handling the data.
I would like the follow-up communication to answer a few specific questions. Was my information involved? Which fields or documents were affected? Who held them, and why? What support will be available if those details are misused?
And if those answers are still being investigated, tell me when I can expect another update.
I can accept that a proper investigation takes time. Sending an early warning is preferable to leaving customers unaware while every detail is checked. While this should not be treated as evidence that EasyEquities handled the incident badly, or that anybody has already established negligence, but the email has started a conversation that needs to continue.
I trusted EasyEquities with information about me and I still expect EasyEquities to explain where that information went and what happens next.
