Regulator fines Fidelity Brokerage Services $1.25M over data breach

Fidelity Brokerage Services experienced a data breach on Aug 17–19, 2024 in which an attacker used true name fraud to log in and ran an automated script generating ~23.7 million image ID requests; about 373,000 unique document images tied to roughly 77,000 customers were accessed. The activity triggered an alert initially thought to be a small DDoS, but was an enumeration attack; Massachusetts ordered Fidelity to pay $1.25M for insufficient cybersecurity controls and notification failures, and Fidelity settled related class-action litigation.