300k Finsure Customer Records Exposed via Third‑Party Marketing Platform Breach
What Happened — In October 2024, the ActivePipe real‑estate marketing platform disclosed a dataset containing 296,124 unique email addresses belonging to Australian mortgage‑broking group Finsure. The leak also included names, phone numbers and physical addresses. No passwords or financial data were compromised, and the breach did not originate from Finsure’s own systems.
Why It Matters for Trust & Control Assurance
- This incident exemplifies a supply‑chain data‑exposure scenario that a continuous control‑assurance program is built to detect, document and remediate.
- Demonstrating ongoing vendor oversight and evidence of due‑diligence satisfies a core control objective—third‑party risk management—which maps to many frameworks (e.g., NIST CSF 2.0).
- Leveraging Verisq’s Third‑Party Risk Management capability provides a defensible audit trail of vendor assessments, monitoring logs and remediation actions.
Who Is Affected – Mortgage‑broking firms, their customers, and any organization that relies on third‑party marketing or CRM platforms for personal data.
Recommended Actions
- Review and update contracts with ActivePipe to include explicit data‑handling and breach‑notification clauses.
- Conduct a third‑party risk assessment focused on data protection controls (encryption, access, retention).
- Deploy continuous monitoring of vendor security posture and integrate findings into your audit evidence repository.
- Verify that incident‑response playbooks cover third‑party data‑exposure events and test them.
Technical Notes – The exposure stemmed from a data‑export process on the ActivePipe platform; no specific CVE was disclosed. Affected data types: email addresses, full names, telephone numbers, and mailing addresses. Source: https://haveibeenpwned.com/api/v3/breach/Finsure