“When reached by TechCrunch, Fidelity did not say how the creation of two Fidelity customer accounts allowed access to the data of thousands of other customers.”
Someone opened two customer accounts and used them to pull documents on 77,099 people, Social Security numbers and driver’s licenses included, between August 17 and 19. Fidelity’s own filing says the attacker sent “fraudulent requests to an internal database that housed images of documents.” The firm holds $14.1 trillion for 51 million investors and its message is that no accounts “or funds” were touched. The identity documents left through two accounts anyone could open.