Pierluigi Paganini
December 05, 2013
JPMorgan Chase & Co has announced that it was the victim of a cyber attack and warned around 465,000 of its holders of prepaid cash cards on the possible exposure of their personal information.
The intrusion in the JPMorgan Chase & Co network occurred in July and hackers may have accessed customers personal data, the cards were issued for corporations and government agencies.
The 465,000 accounts compromised account for about 2% of the overall 25 million UCard users, the JPMorgan confirmed that there are no risk for holders of debit cards, credit cards or prepaid Liquid cards.
JPMorgan discovered that the servers that host the site www.ucard.chase.com was compromised in September and promptly informed the law enforcement to start the investigation, no information on how attackers have conducted the attack has been disclosed.
The JPMorgan spokesman Michael Fusco declared that the investigation allowed the identification of victim accounts and the data stolen, the bank already notifying the cardholders of the incident. JPMorgan representative also remarked that hackers haven’t stolen money from any user’s account, due this reason the company is not issuing replacement cards but is only offering the cardholders a year of free credit-monitoring services (in my opinion a proper act, given what happened).
“The bank typically keeps the personal information of its customers encrypted, or scrambled, as a security precaution. However, during the course of the breach, personal data belonging to those customers had temporarily appeared in plain text in files the computers use to log activity.” reported the Reuters agency.
I confess that the above statement made me literally jump out of the chair, what does it mean that “customers had temporarily appeared in plain text in files the computers use to log activity“, if confirmed the situation is very embarrassing.
The bank experts sustain that only “a small amount” of data was exposed during the data breach , the information according the company doesn’t include social security numbers and other personal information like birth dates and email addresses that could be used by cyber criminals for financial frauds and identity theft.
At the moment there is an absolute reserve on the names of the victims and there is no idea on the origin of the attack. The cybercrime considers the type of information acquired a precious commodity for sale in the underground, security experts Stewart from Dell SecureWorks and independent researcher David Shearhave recently published a study on the online underground marketplace for stolen data, the analysis revealed for example that it is quite easy to buy credit card information for a little more than ten dollars.
Banking institutions are privileged targets for cybercriminals as I explained in my post on Online banking cybercrime, in 2007 some 41 million credit and debit card numbers from major retailers, including the owner of T.J. Maxx stores, were stolen.
It is just the beginning!
(Security Affairs – JPMorgan Chase, cybercrime)
