- Apr 13, 2013
- 3,150
JP Morgan Chase, one of the largest banks in the US, said on Thursday that a massive computer hack affected the accounts of 76 million households and about seven million small businesses, making it one of the largest of its kind ever discovered.
The attack was under way for a month before it was discovered in July, and when it was disclosed in August, the bank estimated that about one million accounts had been compromised. But the latest information revealed on Thursday showed the attack was vastly more serious than earlier thought.
The bank said financial information was not compromised and that there had been no breach of login information such as account or social security numbers, passwords or dates of birth. However, names, email addresses, phone numbers and addresses of account holders were captured by hackers. “As of such date, the firm continues not to have seen any unusual customer fraud related to this incident,” the bank said in a regulatory filing. It said customers would not be liable for unauthorised transactions on their account, so long as they promptly alerted the bank.
JP Morgan, the largest bank in the country by assets, is working with the Federal Bureau of Investigation and the US secret service to determine the roots of the attack. The scale of the hack, one of the largest ever, comes after a series of massive data breaches at US institutions and follows in the wake of attacks on Target and Home Depot.
In September, Home Depot confirmed its payment systems were breached in an attack that some estimated impacted 56m payment cards. Last year’s attack on Target impacted 40m payment cards and compromised the personal details of some 70m people. But the JP Morgan hack is considerably more serious, as banks holds far more sensitive information than retailers.
In August, Bloomberg reported that the attack on JP Morgan had been linked to Russian hackers who FBI sources said had been able to extract “gigabytes of sensitive data”. The filing came as the true scale of the compromise became clear to bank executives. The hack began in June but was not discovered until July and criminals were able to access the accounts of more than 90 servers. The attackers may originally have entered JP Morgan’s systems after hacking into the computer of one of the bank’s own employees.
Brian Krebs, security expert said: “Reality is dawning among regular corporations that you can’t keep these guys out. The most you can do is stop the bleeding. It’s not clear yet how well that worked here. A month is a long time. My sense is that if an attack is as directed as these guys appear to have been, you would expect that they will make it cost you.”
Earlier this year Jamie Dimon, JP Morgan’s chief executive, told shareholders the bank would spend $250m a year on cybersecurity, employing 1,000 people to oversee its systems. “It is going to be a continual and likely never-ending battle to stay ahead of it - and, unfortunately, not every battle will be won,” Dimon wrote in his annual letter to shareholders.
The attack was under way for a month before it was discovered in July, and when it was disclosed in August, the bank estimated that about one million accounts had been compromised. But the latest information revealed on Thursday showed the attack was vastly more serious than earlier thought.
The bank said financial information was not compromised and that there had been no breach of login information such as account or social security numbers, passwords or dates of birth. However, names, email addresses, phone numbers and addresses of account holders were captured by hackers. “As of such date, the firm continues not to have seen any unusual customer fraud related to this incident,” the bank said in a regulatory filing. It said customers would not be liable for unauthorised transactions on their account, so long as they promptly alerted the bank.
JP Morgan, the largest bank in the country by assets, is working with the Federal Bureau of Investigation and the US secret service to determine the roots of the attack. The scale of the hack, one of the largest ever, comes after a series of massive data breaches at US institutions and follows in the wake of attacks on Target and Home Depot.
In September, Home Depot confirmed its payment systems were breached in an attack that some estimated impacted 56m payment cards. Last year’s attack on Target impacted 40m payment cards and compromised the personal details of some 70m people. But the JP Morgan hack is considerably more serious, as banks holds far more sensitive information than retailers.
In August, Bloomberg reported that the attack on JP Morgan had been linked to Russian hackers who FBI sources said had been able to extract “gigabytes of sensitive data”. The filing came as the true scale of the compromise became clear to bank executives. The hack began in June but was not discovered until July and criminals were able to access the accounts of more than 90 servers. The attackers may originally have entered JP Morgan’s systems after hacking into the computer of one of the bank’s own employees.
Brian Krebs, security expert said: “Reality is dawning among regular corporations that you can’t keep these guys out. The most you can do is stop the bleeding. It’s not clear yet how well that worked here. A month is a long time. My sense is that if an attack is as directed as these guys appear to have been, you would expect that they will make it cost you.”
Earlier this year Jamie Dimon, JP Morgan’s chief executive, told shareholders the bank would spend $250m a year on cybersecurity, employing 1,000 people to oversee its systems. “It is going to be a continual and likely never-ending battle to stay ahead of it - and, unfortunately, not every battle will be won,” Dimon wrote in his annual letter to shareholders.
