Fidelity Investments Discloses Security Breach: 77,000 Customer Records and SSNs Compromised via Rogue Accounts

In mandatory breach notification filings submitted to state attorneys general and regulators over the weekend, wealth management and brokerage giant Fidelity Investments disclosed that an unauthorized third party compromised the sensitive personal and financial data of 77,099 customers. Between August 17 and August 19, 2024, the attacker registered two fraudulent customer accounts and leveraged an authorization flaw within an internal document retrieval microservice to access and exfiltrate customer document images containing Social Security numbers and bank statements.

How the Breach Occurred: Broken Object-Level Authorization (BOLA)

Fidelity clarified that the attackers did not breach internal network perimeters or deploy malware. Instead, the attackers abused the legitimate customer onboarding workflow:

1. The attacker created two newly registered customer accounts through normal public onboarding channels.
2. Once authenticated as legitimate new users, the attacker probed internal API endpoints responsible for rendering submitted customer verification documents (e.g., driver's licenses, tax forms, account verification statements).
3. Because the backend microservice failed to validate whether the requesting user owned the requested document resource ID (an API flaw categorized as Broken Object-Level Authorization / BOLA - OWASP API1:2023), the attacker iterated through sequential or predictable document indices to retrieve images belonging to unrelated clients.

# Simulated BOLA flaw exploited in customer document viewer
GET /api/v2/customer/documents/view?doc_id=DOC-2024-984210 HTTP/1.1
Host: accounts.fidelity.com
Authorization: Bearer [Attacker_Legitimate_JWT_Token]

# Response: Returns document image belonging to a DIFFERENT customer!
HTTP/1.1 200 OK
Content-Type: image/tiff
Content-Disposition: inline; filename="w9_tax_form_ssn.tif"

Compromised Information and Organizational Response

According to official disclosure filings:

• Exposed Records: Full legal names, home addresses, dates of birth, Social Security numbers (SSNs), driver's license numbers, and bank account documentation.
• Unaffected Systems: Fidelity emphasized that core investment portfolios, account balances, trading platforms, and customer login credentials were not accessed or altered. No customer funds were stolen.
• Containment: Fidelity detected the anomalous bulk access on August 19, terminated the two rogue accounts, patched the vulnerable authorization endpoint, and retained external digital forensics specialists.
• Victim Mitigation: All 77,099 impacted customers were offered 24 months of complimentary credit monitoring and identity restoration services via TransUnion Interactive.

Detection Telemetry & Threat Hunting

Remediation & Defense Architecture

1. Strict Object-Level Authorization: Enforce cryptographically bound user-to-resource ownership checks in middleware. Every document retrieval query must verify: WHERE document_id = ? AND account_owner_id = session.user_id.
2. Use Cryptographically Secure UUIDv4: Replace predictable or sequential document identifiers with randomized 128-bit UUIDs or encrypted signed tokens (HMAC-SHA256) containing time-limited viewing capabilities.
3. Velocity & Anomaly Detection on Document Viewers: Trigger automatic account suspension if a newly created customer account attempts to query more than 5 distinct document entities within an hour.