Insignia Financial (ASX:IFL) said that, based on its investigations, the recent cyber attack appears to involve a malicious third party using "credential stuffing" activity, involving an unusual number of login attempts at the Expand platform, according to a Friday Australian bourse filing.

Insignia has not observed similar activity impacting other customer-facing platforms.

It detected suspicious activity on around 100 Expand Wrap Platform customers' accounts and there had been no financial impact on customers, according to MLC Expand's Chief Executive Liz McCarthy.

The firm is communicating with impacted customers and their advisors and is working to apply additional monitoring and mitigations to protect customer accounts.

Its shares fell over 6% on market close.