Around 8-weeks ago we contacted our brokers to inform them of mortgage client data that was made available on the Dark Web. Clearly an inside job, the records of hundreds of brokers that had subscribed to a Philippine-based staffing company had extremely extensive details made available for sale. We contacted the company and learned that despite their claim of 'cutting-edge' security, their entire library of content was maintained on OneDrive (something they blamed on lockdowns).
Did they self-resport as required by law? No. Why? They (likely) defaulted to their local laws that aren't enforced, or aren't applicable. Did they notify their clients? No.
It's the second part that bothers me most.
The same situation played out with a Serbian-based processing company earlier in the year... and I've lost count of how many times we've seen the same thing in the last 20+ years.
The MO is always the same, and the result is usually the theft of funds, often with the support of local actors.
For an industry that invests so much into compliance, our privacy and data obligations are often ignored. We need to have a serious conversation about the cost/benefit of unvetted offshore processing when quality control is lost and data security is crap.
