More than a thousand Booster customer accounts have been accessed without authorisation after login credentials were obtained from an external source, the KiwiSaver provider has confirmed.

In a statement sent to Chris Lynch Media, Chief Executive Diana Papadopoulos said the company’s monitoring systems detected the suspicious activity and the affected accounts were locked down to prevent further access.

“Booster has identified a cybersecurity incident involving unauthorised access to a small number of our customer accounts using login credentials obtained from an external source,” Papadopoulos said.

“Our investigations have confirmed no evidence that Booster’s systems have been breached.”

In emails to affected customers, Booster said the correct username and password had been used in each case but the activity was flagged as suspicious by its monitoring systems.

The company said it had not identified any suspicious transactions, changes to account details or misuse of personal information at this stage.

Approximately 1,387 accounts were identified as impacted out of a customer base of more than 200,000.

Booster has taken a precautionary approach and contacted a wider group of customers, encouraging them to reset their passwords and enable multi-factor authentication.

Affected customers will be prompted to reset their passwords on their next login. Booster said it strongly recommended all customers enable MFA, which provides an additional layer of protection by requiring a code at login.

“MFA helps to protect against malicious attackers accessing digital accounts, so we always encourage people to set this up,” Papadopoulos said. “We’re also recommending people use unique passwords for any accounts they have.”

Cybersecurity experts have been engaged to assist with the response.

Booster is one of six government-appointed default KiwiSaver scheme providers and manages more than $8 billion on behalf of investors across KiwiSaver, superannuation and investment funds.