Perpetual 'extended outage' caused by security incident at third-party

ASX-listed wealth and asset management firm Perpetual Limited said a security incident at a third-party is behind an “extended outage” to some systems, notably its customer-facing myPerpetual platform.

The outage and incident was first reported by the Australian Financial Review, which said the problems had been going on since June 6 and were impacting about 45,000 clients.

Clients told the newspaper they had been unable to access myPerpetual or withdraw funds for weeks.

In a statement on myPerpetual, dated today, Perpetual said that “work is underway to restore online services impacted by an extended outage in a safe and secure environment.”

“Core systems have been restored and we will begin processing transactions and payment requests that we have received,” the company said.

Perpetual said the problem is with a unit registry system provided by an unnamed third-party. Such a system is used to maintain records about investors to meet legal requirements.

Perpetual said that its “registry provider’s system” had been impacted by an incident that involved “unauthorised access”.

The company said it “places the highest priority on the privacy and security of its clients’ information and is working with the external unit registry provider and external forensic IT experts to investigate the incident as a matter of urgency and priority.”

“At this stage, the investigations have not identified any notifiable data breach from this incident.”

In a separate statement on Perpetual’s main website, the company said the third-party in question “provides unit registry and administration services to Perpetual's Asset Management and Wealth Management divisions’ investment funds, WealthFocus and Select products.”

It added that there is “no impact to Perpetual's listed products, institutional mandates, Pendal, Perpetual Corporate Trust, Perpetual Wrap clients or any of our international asset management businesses.”

“Importantly, there is no impact to any Perpetual client investments, or our own systems, which remain safe and secure,” Perpetual said.

Perpetual said some systems, transaction processing and payments capabilities had been restored as of Wednesday, but myPerpetual remained inaccessible.