2014 JPMorgan Chase data breach
![]() | |
Time | 2011 – May 2015 |
---|---|
Duration | c. 3 Years 6 Months |
Location | New York City |
Type | Data breach |
Arrests | 4 |
Suspects | 4 |
Accused | 4 |
Convictions | 4 |
The 2014 JPMorgan Chase data breach was a cyberattack against American bank JPMorgan Chase that is believed to have compromised data associated with over 83 million accounts—76 million households (approximately two out of three households in the country) and 7 million small businesses.[1] The data breach is considered one of the most serious intrusions into an American corporation's information system and one of the largest data breaches in history.[2][3][4]
The cyberattack
The attack—disclosed in September 2014—was discovered by the bank's security team in late July 2014, but not completely halted until the middle of August.[3][5] The bank declared that login information associated with the accounts (such as social security numbers or passwords) was not compromised but names, email and postal addresses, and phone numbers of account holders were obtained by hackers, raising concerns of potential phishing attacks.[4][6]
The attack targeted nine other major financial institutions alongside JPMorgan Chase.[3][7] As of October 9, the only other company believed to have had data stolen is Fidelity Investments[8] but investigators reported that the attack attempted to infiltrate the networks of banks and financial companies such as Citigroup, HSBC Holdings, E*Trade, Regions Financial Corporation and payroll-service firm Automatic Data Processing (ADP).[9]
Indictments and extradition
US federal indictments were issued against four hackers in the massive fraud in November 2015.[10] Two Israelis indicted, Gery Shalon and Ziv Orenstein, were arrested in Israel and will be extradited to the U.S. according to Israel's Justice Ministry.[11] American hacker Joshua Samuel Aaron had also been part of the indictments.[12] They were charged with 23 counts of computer hacking affecting over 100 million customers.[13] Shalon and Orenstein pled guilty. Joshua Samuel Aaron was arrested in Dec 2016.[14] A fourth individual, Andrei Tyurin, was extradited to the US from the Republic of Georgia to face charges in 2018.[15]
References
- ^ Siegel Bernard, Tara (3 October 2014). "Ways to Protect Yourself After the JPMorgan Hacking". The New York Times. Archived from the original on 4 October 2014. Retrieved 5 October 2014.
- ^ "JPMorgan hack exposed data of 83 million, among biggest breaches in history". Reuters. 2 October 2014. Archived from the original on 29 December 2015. Retrieved 5 October 2014.
- ^ a b c Goldstein, Matthew; Perlroth, Nicole; Sanger, David E. (2014-10-03). "Hackers' Attack Cracked 10 Financial Firms in Major Assault". The New York Times. Archived from the original on 2020-12-16. Retrieved 2014-10-04.
- ^ a b Rushe, Dominic (2 October 2014). "JP Morgan Chase reveals massive data breach affecting 76m households". The Guardian. Archived from the original on 4 October 2014. Retrieved 5 October 2014.
- ^ Chan, Cathy (2014-10-02). "Hackers' Attack on JPMorgan Chase Affects Millions". The New York Times. Archived from the original on 2021-02-12. Retrieved 2014-10-02.
- ^ Santus, Rex (3 October 2014). "What You Need to Know About the JPMorgan Chase Cyberattack". Mashable. Archived from the original on 5 October 2014. Retrieved 5 October 2014.
- ^ Woodyard, Chris (4 October 2014). "Report: Russian hackers behind JPMorgan Chase attack". USA Today. Archived from the original on 4 October 2014. Retrieved 5 October 2014.
- ^ Barrett, Devlin (9 October 2014). "J.P. Morgan Hackers Also Stole Fidelity Data, Investigators Think". The Wall Street Journal. Archived from the original on 8 January 2015. Retrieved 9 October 2014.
- ^ Riley, Michael (9 October 2014). "JPMorgan Hackers Said to Probe 13 Financial Firms". Bloomberg. Archived from the original on 10 October 2014. Retrieved 10 October 2014.
- ^ Zetter, Kim (10 November 2015). "Four Indicted in Massive JP Morgan Chase Hack". WIRED. Archived from the original on 31 December 2016. Retrieved 4 March 2017.
- ^ "2 Israelis in JPMorgan Chase cyber fraud case to be extradited". Jewish Telegraphic Agency. 9 May 2016. Archived from the original on 17 February 2018. Retrieved 23 March 2023.
- ^ "Suspected JP Morgan hacker arrested after returning from Moscow". CBS News. 14 December 2016. Archived from the original on 23 March 2023. Retrieved 23 March 2023.
- ^ Crowe, Portia (Nov 10, 2015). "JPMorgan fell victim to the largest theft of customer data from a financial institution in US history". businessinsider.com.
- ^ Whitehouse, Kaja (Dec 15, 2016). "Accused bank hacker claims Russia offered him asylum". nypost.com.
- ^ Kosman, Josh (2018-09-10). "Hacker behind largest breach in US history appears in court". Retrieved 2024-08-24.
External links
- https://www.justice.gov/opa/file/792651/download
- https://www.justice.gov/opa/file/792656/download
- https://www.justice.gov/usao-sdny/file/632156/download
- https://www.justice.gov/usao-sdny/press-release/file/1092376/download
- https://www.justice.gov/usao-sdny/press-release/file/1092381/download
- v
- t
- e
← 2000s | Timeline | 2020s → |
2010 |
|
---|---|
2011 |
|
2012 | |
2013 |
|
2014 |
|
2015 | |
2016 |
|
2017 | |
2018 | |
2019 |
persistent threats
- Bangladesh Black Hat Hackers
- Bureau 121
- Charming Kitten
- Cozy Bear
- Dark Basin
- DarkMatter
- Elfin Team
- Equation Group
- Fancy Bear
- GOSSIPGIRL (confederation)
- Guccifer 2.0
- Hacking Team
- Helix Kitten
- Iranian Cyber Army
- Lazarus Group (BlueNorOff) (AndAriel)
- NSO Group
- Numbered Panda
- PLA Unit 61398
- PLA Unit 61486
- PLATINUM
- Pranknet
- Red Apollo
- Rocket Kitten
- Stealth Falcon
- Syrian Electronic Army
- Tailored Access Operations
- The Shadow Brokers
- xDedic
- Yemen Cyber Army
publicly disclosed
- Evercookie (2010)
- iSeeYou (2013)
- Heartbleed (2014)
- Shellshock (2014)
- POODLE (2014)
- Rootpipe (2014)
- Row hammer (2014)
- SS7 vulnerabilities (2014)
- WinShock (2014)
- JASBUG (2015)
- Stagefright (2015)
- DROWN (2016)
- Badlock (2016)
- Dirty COW (2016)
- Cloudbleed (2017)
- Broadcom Wi-Fi (2017)
- EternalBlue (2017)
- DoublePulsar (2017)
- Silent Bob is Silent (2017)
- KRACK (2017)
- ROCA vulnerability (2017)
- BlueBorne (2017)
- Meltdown (2018)
- Spectre (2018)
- EFAIL (2018)
- Exactis (2018)
- Speculative Store Bypass (2018)
- Lazy FP state restore (2018)
- TLBleed (2018)
- SigSpoof (2018)
- Foreshadow (2018)
- Dragonblood (2019)
- Microarchitectural Data Sampling (2019)
- BlueKeep (2019)
- Kr00k (2019)
2010 |
|
---|---|
2011 | |
2012 | |
2013 | |
2014 | |
2015 | |
2016 | |
2017 | |
2018 | |
2019 |
|