Pierluigi Paganini October 03, 2014

The cyberattack that compromised systems at JPMorgan Chase exposed accounts of 76 million households and seven million small businesses.

Data related nearly 76 million households and seven million small business accounts were exposed in the recent hack of the JPMorgan Chase & Co (JPM.N) systems occurred during the summer, making it one of the biggest data breaches in history.

The news on the incident at JPMorgan came after the recent attack against POS systems at Home Depot stores which impacted 56 million cards and the similar attack seen last year against giant IT retailer Target, which compromised 40 million cards.

Names, addresses, phone numbers and email addresses of the holders of victim accounts were exposed, the news was confirmed by JPMorgan in a Form 8-K filing with the Securities and Exchange Commission, fortunately in time I’m writing experts of the company exclude that account numbers, passwords, user IDs, dates of birth or Social Security numbers have been exposed.

The number of victims estimated this summer, just after the disclosure of the news related to the incident, is much lower than found.

Late August, the FBI and the U.S. Secret Service started their investigation speculating on a a “computer-hacking attack” which hit numerous American financial institutions.

In the official statements released through the Chase.com and JPMorganOnline.com websites, JPMorgan confirmed that it hasn’t observed any fraud patterns in the account involved in the incident and it will the situation in the next months to protect its customers.

“There is no evidence that your account numbers, passwords, user IDs, date of birth or Social Security number were compromised during this attack. However, your contact information – name, address, phone number and email address – was compromised.        

Your money at JPMorgan Chase is safe:

Unlike recent attacks on retailers, we have seen no unusual fraud activity related to this incident. Importantly, you are not liable for any unauthorized transaction on your account that you promptly alert us to. ” states the update on cyber security published by Chase.

According the information disclosed online by principal media agencies, including the Wall Street Journal and the New York Times, the hackers compromised more than 90 of JP Morgan’s servers for short periods of time from mid-June to mid-August.

Once the experts at JPMorgan detected the data breach immediately fixed the security flaws exploited by the hackers, according to reports issued by the agencies the attacks originated from overseas, but it hasn’t been disclosed the possible origin.

In the past, most active communities of hackers specialized in such kind of attacks were located in Eastern Europe or Russia, and also this time experts speculated that those areas could be the base of the criminals which hit JPMorgan.

The New York Times also speculated a possible involvement of state-sponsored hackers due to the lack of profit motive:

“That lack of any apparent profit motive has generated speculation among the law enforcement officials and security experts that the hackers, which some thought to be from Southern Europe, may have been sponsored by elements of the Russian government, the people with knowledge of the investigation said.”

It’s my opinion that the fact that no abnormal activity was seen since now should not reassure the customers of the bank, it is very likely that the organization behind the attack wants to use the stolen information for subsequent attacks, such as phishing campaigns on a large scale.

Stay tuned for further information.

Pierluigi Paganini

(Security Affairs – JPMorgan, data breach)