Data Breach at Analytics Company Exposes Information of FirstBank Puerto Rico Customers

Customers of FirstBank Puerto Rico, which includes the Virgin Islands, need to monitor their mail, as the Mortgage Industry Advisory Corporation (MIAC) earlier this month filed notice with the Vermont Attorney General’s office that some FirstBank customers had been the victims of a data breach.

MIAC, which according to the data breach notice “provides loan valuation and other financial analytics services” to FirstBank, says it suffered a cyberattack on its computer systems on April 6. It soon became apparent that the company had been subjected to a ransomware attack, and further, that the intruders had accessed data stored on MIAC’s systems on the day of the attack as well as the day prior.

Almost a month later, MIAC determined that some customers of FirstBank Puerto Rico were affected by the data breach, and informed the bank of the issue on May 4.

The form letter seen by Consortium journalists, issued by MIAC, includes a field which will inform the affected user which of their data records were accessed by the unauthorized intruders.

MIAC has offered affected FirstBank customers up to two years of free credit monitoring and identity protection, and have asked recipients of the notice to “remain vigilant against incidents of identity theft and fraud over the next twelve to twenty-four months”. People who receive the data breach notice are advised to pay close attention to bank statements, and to immediately report discrepancies or suspicious activity to FirstBank.

It is currently unclear whether customers outside of Puerto Rico have been affected by the data breach.