cyber daily logo

Breaking news and updates daily. Subscribe to our Newsletter

Breaking news and updates daily. Subscribe to our Newsletter X facebook linkedin Instagram Instagram

Exclusive: Aussie lender Firstmac falls victim to EMBARGO ransomware gang

Hackers claim to have databases, source codes, and “sensitive customer data” a day after the lender notified customers of possible data breach.

user icon David Hollingworth
Wed, 01 May 2024
Exclusive: Aussie lender Firstmac falls victim to EMBARGO ransomware gang
expand image

A fledgling ransomware gang has taken responsibility for hacking Australian non-bank lender Firstmac.

In fact, Firstmac is only the second victim of the EMBARGO gang after it claimed its first victim – the Mulford Construction Company in the US – on 21 April.

EMBARGO posted about the Firstmac hack on its darknet leak site overnight on 30 April, the same day that Firstmac notified its customers of the cyber incident.


According to EMBARGO, the hackers stole more than 500 gigabytes of data, including “full databases, source codes, [and] sensitive customer data”.

The gang has not said its ransom demand or shared any proof of the hack. A countdown on the leak site points to a ransom deadline of 8 May.

Firstmac said it had been impacted by a “cyber incident” in an email seen by multiple media outlets, including Momentum Media stablemate Mortgage Business.

“We recently experienced a cyber incident where an unauthorised third party accessed a limited part of our IT system,” a Firstmac spokesperson told Mortgage Business yesterday (30 April).

“As soon as we detected the incident, we took steps to secure our system. We also engaged forensic experts to investigate what has happened. Our investigation is ongoing.

“As our investigation continues, we will continue to communicate with all our stakeholders in a timely and transparent manner throughout this process, in line with our values as a family business that treats our customers as real people.”

Being a new operation, EMBARGO is relatively unknown. On its about page, the gang describes itself as “an international team without any political affiliations”.

UPDATE 01/05/24: When contacted for further comment on the ransomware attack, Firstmac responded with the same statement supplied to Mortgage Business.

David Hollingworth

David Hollingworth

David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.

cd intro podcast

Introducing Cyber Daily, the new name for Cyber Security Connect

Click here to learn all about it
cyber daily subscribe
Be the first to hear the latest developments in the cyber industry.