HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)CredentialsLowContained

OANDA CORPORATION

bd_931f2fe241f97100 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 3, 2014

Filed

Mar 5, 2014

To disclose

2 days

Affected

Not disclosed

Confidence

69%

Full breach record for OANDA CORPORATION →

On March 3, 2014, OANDA Corporation experienced an unauthorized breach affecting a server containing historical PayPal payment logs (pre-2007) and credentials for the 'fxPense' expense reporting tool. Exposed data included names, email addresses, and fxPense usernames/passwords. The incident did not impact fxTrade services, client trades, or funds. OANDA disabled access, notified the FBI and regulators, and conducted a security review.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 2 days

Mar 3, 2014

Begins

Mar 3, 2014

Discovered

Mar 5, 2014

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: OANDA CORPORATION
norm: oanda

Name: OANDA CORPORATION
norm: oanda
Industry: Financial Servicesllm

Discovered: Mar 3, 2014
Breach occurred: Mar 3, 2014 – Mar 3, 2014
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Alerted the Federal Bureau of Investigation (FBI)Alerted regulators and relevant privacy offices

During the incident: Disabled the means of access immediately upon detecting the breach
Alerted the Federal Bureau of Investigation (FBI)
Alerted regulators and relevant privacy offices
Completed a careful review of system services and logs
Undertaking an additional study of security across all systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 2 days(2 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-44326
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 5, 2014
Raw hash: 0469527cb6f528190477cc6d443de49152ce291dd7cd2638d3036490113b76b1

Reporting entityOANDA CORPORATION

Victim entityOANDA CORPORATION

Incidentdiscovered Mar 3, 2014

Stated responseDisabled the means of access immediately upon detecting the breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov