JPMorgan Chase Hack Affects 76 Million, Largest Hack Yet

[Gagaloo911 12,959]

Breach affects many of us, compromised data may include telephone numbers, addresses and even social security numbers.

 

 

 

A cyberattack this summer on JPMorgan Chase compromised the accounts of 76 million households and seven million small businesses, a tally that dwarfs previous estimates by the bank and puts the intrusion among the largest ever.
The details of the breach  disclosed in a securities filing on Thursday  emerge at a time when consumer confidence in the digital operations of corporate America has already been shaken. Target, Home Depot and a number of other retailers have sustained major data breaches. Last year, the information of 40 million cardholders and 70 million others were compromised at Target, while an attack at Home Depot in September affected 56 million cards.
But unlike retailers, JPMorgan, as the largest bank in the nation, has financial information in its computer systems that goes beyond customers’ credit card details and potentially includes more sensitive data.
“We’ve migrated so much of our economy to computer networks because they are faster and more efficient, but there are side effects,†said Dan Kaminsky, a researcher who works as chief scientist at White Ops, a security company.
Until just a few weeks ago, executives at JPMorgan said they believed that only one million accounts were affected, according to several people with knowledge of the attacks.
As the severity of the intrusion  which began in June but was not discovered until July  became more clear in recent days, bank executives scrambled for the second time in three months to contain the fallout and to reassure skittish customers that no money had been taken and that their financial information remained secure.
The hackers appeared to have obtained a list of the applications and programs that run on JPMorgan’s computers  a road map of sorts  which they could crosscheck with known vulnerabilities in each program and web application, in search of an entry point back into the bank’s systems, according to several people with knowledge of the results of the bank’s forensics investigation, all of whom spoke on the condition of anonymity.
Operating overseas, the hackers gained access to the names, addresses, phone numbers and emails of JPMorgan account holders. In its regulatory filing on Thursday, JPMorgan said that there was no evidence that account information, including passwords or Social Security numbers, had been taken. The bank also noted that there was no evidence of fraud involving the use of customer information.
Still, until the JPMorgan breach surfaced in July, banks were viewed as relatively safe from online assaults because of their investment in defenses and trained security staff. Most previous breaches at banks have involved stealing personal identification numbers for A.T.M. accounts, not burrowing deep into the internal workings of a bank’s computer systems.
Even if no customer financial information was taken, the apparent breadth and depth of the JPMorgan attack shows how vulnerable Wall Street institutions are to cybercrime. In 2011, hackers broke into the systems of the Nasdaq stock market, but did not penetrate the part of the system that handles trades.
Photo

Jamie Dimon, JPMorgan’s chairman and chief executive, has acknowledged the growing digital threat. In his annual letter to shareholders, Mr. Dimon said, “We’re making good progress on these and other efforts, but cyberattacks are growing every day in strength and velocity across the globe.â€
Even though the bank has fortified its defenses against the attacks, Mr. Dimon wrote, the battle is “continual and likely never-ending.â€
On Thursday, some lawmakers weighed in. Edward J. Markey, Democrat of Massachusetts and a member of the Senate Commerce Committee, said “the data breach at JPMorgan Chase is yet another example of how Americans’ most sensitive personal information is in danger.â€
Hackers drilled deep into the bank’s vast computer systems, reaching more than 90 servers, the people with knowledge of the investigation said. As they a--lyze the contours of the breach, investigators in law enforcement remain puzzled, partly because there is no evidence that the attackers looted any money from customer accounts.
That lack of any apparent profit motive has generated speculation among the law enforcement officials and security experts that the hackers, which some thought to be from Southern Europe, may have been sponsored by elements of the Russian government, the people with knowledge of the investigation said.
By the time the bank’s security team discovered the breach in late July, hackers had already obtained the highest level of administrative privilege to dozens of the bank’s computer servers, according to the people with knowledge of the investigation. It is still unclear how hackers managed to gain such deep access.
The people with knowledge of the investigation said it would take months for the bank to swap out its programs and applications and renegotiate licensing deals with its technology suppliers, possibly giving the hackers time to mine the bank’s systems for unpatched, or undiscovered, vulnerabilities that would allow them re-entry into JPMorgan’s systems.
Beyond its disclosures, JPMorgan did not comment on what its investigation had found. Kristin Lemkau, a JPMorgan spokeswoman, said that describing the bank’s breach as among the largest was “comparing apples and oranges.â€
Preparing for the disclosure on Thursday, JPMorgan retained the law firm WilmerHale to help with its regulatory filing with the Securities and Exchange Commission, people with knowledge of the matter said. Earlier on Thursday, some executives  Barry Sommers, the chief executive of Chase’s consumer bank  flew back to New York from Naples, Fla., where they had convened for a leadership conference, these people said.
The initial discovery of the hack sent chills down Wall Street and prompted an investigation by the Federal Bureau of Investigation. The bank was also forced to update its regulators, including the Federal Reserve, on the extent of the breach.
Faced with the rising threat of online crime, JPMorgan has said it plans to spend $250 million on digital security annually, but had been losing many of its security staff to other banks over the last year, with others expected to leave soon.

Source: http://dealbook.nytimes.com/2014/10/02/jpmorgan-discovers-further-cyber-security-issues/?_php=true&_type=blogs&ref=us&_r=0

 

 

This just goes to show how vulnerable all our data these companies collect about us really is. If any of you bank with Chase or have credit cards of some sort, it's time now to be on the lookout for fraudulent activity on your account.

 

If you bank with Chase, or are just worried you may be affected, here is some useful info on precautions to take: http://www.nytimes.com/2014/10/04/your-money/jpmorgan-chase-hack-ways-to-protect-yourself.html?hp&action=click&pgtype=Homepage&module=second-column-region&region=top-news&WT.nav=top-news

[Morphine Prince 109,687]

Glad I'm not with Chase.

[Jjang 2,262]

*Terrifying...

[badboymonsterx 555]

ugh.. FML

[VISION 52]

I'm with Chase What should I do?

[Mr Josh 3]

I doubt they'll do anything with the data

[TimisaMonster 31,073]

Glad I closed my Chase account a long time ago....

[Gagaloo911 12,959]

I'm with Chase What should I do?

Just be more cautious and pay more careful attention to your account in case of any suspicious activity.

 

I was reading more about it and it said to be careful of emails you receive in the next year, as this data can be used to create legitimate-looking yet fake emails attempting you to give them more info about you.

 

Most important thing to remember is that companies will never ask for sensitive or personal info over email. You can read more about precautions to take here: http://www.nytimes.com/2014/10/04/your-money/jpmorgan-chase-hack-ways-to-protect-yourself.html?hp&action=click&pgtype=Homepage&module=second-column-region&region=top-news&WT.nav=top-news

I doubt they'll do anything with the data

Lol says you and what evidence? Making that kind of a statement is very ignorant: you have no idea what hackers who have gotten this data will do. They certainly didn't do it just because.

[zexion_armando 241]

Its like every other week, you hear about some major place getting its information compromised.

Target, Chase, Sony, Jennifer Lawrence's breasts, so on and so forth.

 

[Mr Josh 3]

Lol says you and what evidence?

First off pipe down, no need to be rude. It's a fact that many hackers just do attacks in order to brag that they're actually capable of it and to even 'alert' -in a way- about of the vulnerabilities. Others do it for personal gain and money. Many times it's the first example.

 

Making that kind of a statement is very ignorant: you have no idea what hackers who have gotten this data will do. They certainly didn't do it just because.

And neither do you.

[Gagaloo911 12,959]

First off pipe down, no need to be rude. It's a fact that many hackers just do attacks in order to brag that they're actually capable of it and to even 'alert' -in a way- about of the vulnerabilities. Others do it for personal gain and money. Many times it's the first example.

 

And neither do you.

Not being rude, simply saying that a hack involving that many people is not something that can just be brushed off with something as silly as "doubt anything will be done with it". More importantly, we have no idea hat will be done with the data stolen from all the recent data breaches, and likely won't for some time. Just because nothing has not happened yet with it does not mean nothing will happen.

 

And you're right, I do not know. But it's highly unlikely that nothing will happen with all this data now out there.