Australian Financial Services Company is Sued for Repeatedly Being Hacked… and Doing Zero About It

The Australian Securities and Investments Commission (ASIC) is suing RI Advice Group for being hacked multiple times over a year’s time that includes 155 hours of undetected hacker activity.

Internet Hacking Security

If you are the victim of ransomware once, it’s probably inevitable. But if you’re a ransomware victim again, and then hacked on a third occasion, you’re probably not paying attention to the need to properly secure your environment.

According to a notice filed earlier this month in Australian federal court, RI Advice Group was the victim of two remote access-turned-ransomware attacks in December 2016 and May 2017, and a third successful attack on a server containing sensitive financial information and client identification documents in December of 2017. The last one’s the kicker: in a port-mortem analysis, it was determined there were nearly 28K logon attempts – none, of which, were detected – and the hacker stayed logged in using compromised credentials for a total of 155 hours over a period of months leaving behind cryptomining software, a peer-to-peer sharing application, hacking tools, and brute-force password-cracking software. To add insult to injury, a trojan malware attack also occurred in May of 2018.

This company either isn’t paying attention or doesn’t care about their cybersecurity stance.

Because RI Advice Group is a financial services firm, they are subject to the ASIC, who are suing them for failing to establish and maintain compliance measures that include security controls.

I write a lot about the monetary impacts cyber attacks have on organizations, such as paying ransoms. But it’s important to note that there are additional repercussions – like being sued for non-compliance – that can put an organization out of business.

Pay attention – and when the first cybersecurity incident happens, take note, do an analysis of your security controls, and take steps to implement stronger measures that will ensure you’re less vulnerable in the future.


Principal Owner, Law Firm

Our law firm uses IT360, Inc. for all of our technology needs. They not only provide outstanding service at a reasonable fee, but we consider them an integral part of our practice.

Principal Owner, Law Firm

Technology News

IT360 News
Vaccine Research Companies are the Target of New Ransomware Attacks

The U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) warns financial organizations to be aware of campaigns actively targeting vaccine companies If you’re a ransomware gang and you want to maximize your ransom, who do you attack? An organization working feverishly to potentially make billions of dollars via a desperately needed vaccine, of course! Take […]

Read more
IT360 News
[HEADS UP] Allowing Site Notifications Can be Very Costly

Krebs on Security reported that there have been an increasing number of websites asking visitors to approve ‘notifications’. In most cases these notifications are not malicious, but several firms are paying site owners to install notification scripts to sell to scammers. Normally, a website will ask permission to send notifications (as long as you approve […]

Read more