800 Bourse Direct accounts exposed: IBANs of online broker's customers leaked, company confirms

On the night of Tuesday, October 27 to Wednesday, October 28, an intruder accessed customer data at Bourse Direct, the Paris-based online broker founded in 1996 that manages securities accounts and equity savings plans (PEA). Affected customers then received an email referring to “an act of cyber-malevolence that affected their personal information,” according to the site Cyberattaque.org, which was able to view it.

Asked by the site, Bourse Direct confirmed that 800 accounts are affected. The exposed data includes first and last name, the Bourse Direct customer account number and the IBAN of the linked bank account. The broker had nearly 435,000 customer accounts at the end of September, so the leak would affect about 0.2% of them. A number of accounts is not necessarily a number of people.

What reportedly did not leak

According to Bourse Direct, this data alone does not allow access to customers' accounts. No leak of passwords, authentication codes, balances or investment histories is mentioned, nor any theft of securities or funds. The broker says the incident is under control and that its security measures have been strengthened. The relevant authorities are being informed, according to Cyberattaque.org.

How did the intruder get in?

That is the big unknown. Bourse Direct has not said how access was obtained, how long the data remained accessible, or whether it was copied. No hacker group has claimed the attack so far. Financial market players do attract attackers, though: in Bucharest, the central depository, which handles the settlement of Stock Exchange transactions, recently acknowledged that hackers had been able to view investors' IBANs and ID numbers.

What to do if you are a customer

An IBAN alone cannot empty an account. Combined with your name and customer number, however, it lets a scammer credibly pose as your broker or your bank.

• Monitor your bank statements, especially for unknown direct debits. If you find one, dispute it immediately with your bank and, if needed, block debits from that creditor.
• Be wary of unexpected calls, text messages or emails that cite your account number to ask you for a code, a transfer or a “verification.”
• If in doubt, contact the broker through the secure messaging in your customer area or at its usual phone number, never the one given in the message you received.
• For free help, visit cybermalveillance.gouv.fr (France's government cybercrime victim-assistance site).

It remains to be seen whether Bourse Direct will publish a statement on the origin of the intrusion, and whether the figure of 800 accounts will hold once the investigation is over.