Incident
incident:jpmorgan_chase_breach
Also: JPMorgan Chase hack, JPMorgan hack
Multi-month intrusion into JPMorgan Chase involving access to more than ninety servers and theft of customer records.
Multi-month intrusion into JPMorgan Chase involving access to more than ninety servers and theft of customer records.
“they breached over ninety of JPMorgan Chase’s servers”
“The hackers had accessed multiple customer databases and stole 83 million”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | JPMorgan Chase | Explicit | 76 |
| outgoing | COMPROMISES | Corporate Challenge | Explicit | 76 |
| outgoing | INITIAL_ACCESS_VIA | Corporate Challenge | Uncertain | 76 |
| outgoing | INVOLVES | Simmco Data Systems | Explicit | 76 |
| outgoing | INVOLVES | FBI | Explicit | 76 |
| outgoing | INVOLVES | password reuse | Uncertain | 76 |
| outgoing | INVOLVES | spear phishing | Uncertain | 76 |
| outgoing | INVOLVES | two-factor authentication | Explicit | 76 |
| outgoing | INVOLVES | persistence | Explicit | 76 |
| outgoing | INVOLVES | Data exfiltration | Explicit | 76 |
| outgoing | ATTRIBUTED_TO | Andrei Tyurin | Explicit | 76 |
| outgoing | ASSOCIATED_WITH | Gery Shalon | Attributed | 76 |
JPMorgan Chase breach COMPROMISES JPMorgan Chase
The breach compromised JPMorgan Chase's network and customer databases.
Explicit Confidence 99% · Jack Rhysider EP 76 Details
“The biggest bank in America had been hacked and they never even knew it happened.”
JPMorgan Chase breach COMPROMISES Corporate Challenge
The Corporate Challenge charity website was hacked and breached in connection with the JPMorgan investigation.
Explicit Confidence 99% · Jack Rhysider EP 76 Details
“Simmco Data dug around their network logs and confirmed that the Corporate Challenge website was hacked and breached.”
JPMorgan Chase breach INVOLVES Simmco Data Systems
Simmco Data Systems was the hosting provider for the breached Corporate Challenge website and was itself reported as breached.
Explicit Confidence 98% · Jack Rhysider EP 76 Details
“It was hosted by a company called Simmco Data Systems. As it happened, Simmco Data Systems was also mentioned in the Hold Security report.”
JPMorgan Chase breach INVOLVES FBI
JPMorgan Chase contacted the FBI, which investigated the breach.
Explicit Confidence 99% · Jack Rhysider EP 76 Details
“At this point, JPMorgan Chase contacted the FBI”
JPMorgan Chase breach INITIAL_ACCESS_VIA Corporate Challenge
Jack presents access through the Corporate Challenge site, possibly through its hosting provider, as one theory for how the attackers entered the bank's network.
Uncertain Direction flagged Confidence 84% · Jack Rhysider EP 76 Details
“it’s possible that the hacker gained access to this Corporate Challenge charity site. How? Possibly by hacking through Simmco Data Systems”
JPMorgan Chase breach INVOLVES password reuse
Password reuse is presented as a possible mechanism by which credentials from the Corporate Challenge site could have enabled access to JPMorgan's network.
Uncertain Confidence 92% · Jack Rhysider EP 76 Details
“Maybe some of those username and passwords were the same usernames and passwords used to log into JPMorgan Chase’s network.”
JPMorgan Chase breach INVOLVES spear phishing
Targeting a JPMorgan IT administrator through spear phishing is presented as an alternative theory for gaining access.
Uncertain Confidence 94% · Jack Rhysider EP 76 Details
“The other is that this hacker crew might have targeted an IT admin at JPMorgan Chase through spear phishing”
JPMorgan Chase breach INVOLVES two-factor authentication
The neglected employee-benefits server lacked two-factor authentication, which Jack says probably would have stopped the attackers from progressing.
Explicit Confidence 98% · Jack Rhysider EP 76 Details
“This is a perfect example of when two-factor authentication probably would have stopped these hackers from getting any further into the network.”
JPMorgan Chase breach INVOLVES persistence
The hackers created a back door to maintain persistent access to the JPMorgan Chase network.
Explicit Confidence 99% · Jack Rhysider EP 76 Details
“The hackers created a back door into the JPMorgan Chase network.”
JPMorgan Chase breach INVOLVES Data exfiltration
The attackers quietly accessed databases and exported data to their own servers for months.
Explicit Confidence 99% · Jack Rhysider EP 76 Details
“For months, these hackers had been creeping around, quietly accessing databases and exporting data to their own servers”
JPMorgan Chase breach ATTRIBUTED_TO Andrei Tyurin
Andrei Tyurin later admitted to hacking eight US financial institutions, including JPMorgan Chase, as part of the broader scheme.
Explicit Confidence 98% · Jack Rhysider EP 76 Details
“Andrei admitted to conspiracy to commit computer hacking”
“These include JPMorgan Chase, Fidelity, Dow Jones, E-Trade, and Scottrade.”
JPMorgan Chase breach ASSOCIATED_WITH Gery Shalon
Federal investigators concluded that Gery Shalon was pulling the strings on the hacks, while the unidentified hacker carried them out.
Attributed Confidence 96% · Jack Rhysider EP 76 Details
“The feds had confirmed that it was Gery pulling the strings on all these hacks”