ASIC Server Affected by a Cyber Security Incident

​The Australian Securities and Investments Commission (ASIC) revealed on Monday details about the cyber security incident affecting one of the servers used by the commission.

ASIC became aware of the incident related to Accellion software used by the agency to transfer files and attachments on 15 January 2021. It involved illegal access to an ASIC server which contained documents in connection with recent applications for Australian credit licence. No other ASIC technology infrastructure has been impacted or breached.

ASIC said that during the investigation, there is some risk that the threat actor may have viewed some limited information. But up to now, ASIC has found no evidence that any application forms or any attachments were opened or downloaded. As a precaution against potential information leak and systems security threats, ASIC has shut down access to the affected server and notified the relevant agencies as well as impacted parties to respond to and manage the incident.

With the assistance of Accellion, ASIC is now working on alternative arrangements for market participants to submit credit application attachments and will implement the substitute shortly. ASIC's IT team and cyber security advisers engaged by the commission are conducting a meticulous forensic investigation and working to bring systems back online safely.

ASIC has written to directly impacted parties. Relevant agencies and impacted parties can also email contactus@asic.gov.au for additional information.