Daniel Baxter
Nico Ferragamo
Han Vo
Romilla Syed
IT 110
8 December 2015
Data Breaches
The Case
In July of 2014 JPMorgan Chase, a multinational banking and financial services holding company was hacked. JPMorgan Chase is the largest bank in the United States, the sixth largest bank in the world, and the world’s third largest public company. Initial reports from JPMorgan Chase stated that the attack had only breached about one million accounts. Further details revealed that the hack breached the accounts of seventy-six million households (roughly two-thirds of the total number of households in the United States), and about seven million small businesses. While the hack began in July, it was not fully stopped until the middle of August, and it was not disclosed to the public until September. The hack is considered to be one of the most serious attacks on an American Corporation’s information systems and is one of the largest data breaches in history. JPMorgan Chase claims that the login information associated with the accounts (such as social security numbers and passwords) was not compromised, and the information that was stolen had not been involved in any fraudulent activities, however, the names, email addresses, physical addresses, and phone numbers on the accounts were taken by the hackers. The hack was believed to have been committed by a group of Russian hackers. It’s also believed to have been part of a large ring of attempted attacks on as many as nine banks and financial corporations. These include, but are not limited to: Citigroup, HSBC Holdings, E*Trade, Regions Financial Corporation and payroll-service firm Automatic Data Processing (ADP). The only other institution believed to have had data stolen was Fidelity Investments. Dan Kaminsky, a researcher and chief scientist at the White Ops Security Company, eloquently summarized the effect that the digital age is having on the economy: “We’ve migrated so much of our economy to computer networks because they are faster and more efficient, but there are side effects” (New York Times Web).
The Implications
The timing of this data breach was especially inopportune, as it occurred when consumer confidence in American corporations’ security has already been compromised. When the extent of the attack became more apparent, JPMorgan Chase’s Executives had to scramble in an attempt to contain the fallout, as well as convince their customers that no money had been taken from their accounts and that their financial information was still secure. Jessica Silver-Greenberg, Matthew Goldstein, and Nicole Perlroth of the New York Times discussed the effect this breach had on the American public’s view of banks:
Still, until the JPMorgan breach surfaced in July, banks were viewed as relatively safe from online assaults because of their investment in defenses and trained security staff. Most previous breaches at banks have involved stealing personal identification numbers for A.T.M. accounts, not burrowing deep into the internal workings of a bank’s computer systems. (New York Times Web)
Although no financial information was breached, the virtual seriousness of the breach demonstrated how vulnerable financial institutions are to cyber-attacks. In past cyber-attacks on financial institutions, such the 2011 hack of the NASDAQ stock market, the hackers were unable to breach the part of the system that handles the actual information (in this case, the stock trades). The implications of the breach are not only that the customers’ confidence in their bank was shaken, or even that millions of customers’ data could now be used in phishing scams, but also that this breach set a new precedent for what could happen if a corporation’s security is less than stellar.
The Measures Big companies spend incredulous amounts of money, a quarter of a billion dollars in this case, on their security systems, which in theory should make attacks such as the one on JPMorgan Chase a thing of the past. The problem is, while these sophisticated and expensive are all but fool proof, they are not idiot proof. You see, the bank instituted two-factor authentication on their servers prior to the attack. This meant that any hackers would need access to a customer’s email address or phone in order to gain access to their account. This specific security measure could have prevented the hack altogether. The only problem was an oversight. There was a much smaller hack, in the Spring of 2014, in which some employee data when hackers gained access to the bank through a, rather outdated, server that had not been updated to support two-factor authentication. The hacks could have been stopped there when the server was discovered, but instead it was ignored, until the customers’ data was breached that is. This issue seems simple enough to fix, but it is oddly complex. In this specific case, the vulnerability was brought to the banks attention during the earlier and smaller data breach, which in my opinions means that it should’ve been fixed immediately with a simple server update, or server shutdown. But what if there was no earlier breach? If there was no early breach, then the outdated server would never have been brought to the bank’s attention, and it would’ve been much harder to fix. The bank’s electronic presence is so vast that a small oversight like that could be the easiest thing in the world to fix, but it could still be the hardest thing in the world to find. The best way to combat oversights like this would be to have scheduled server maintenance as often as possible without interfering with business. The problem with that is because of the sheer size of many companies, including JPMorgan Chase, any time a server is down for maintenance or testing, it indubitably will interfere with business. This causes corporations to overlook regular server maintenance and just hope for the best, leaving them wide open to attacks. To make breaches like this a thing of the past corporations will have to start putting security ahead of profits. The three main implications of this are as follows: the customers’ confidence in their bank was shaken, the customers’ data was perfect for use in phishing scams, and many people, including people who aren’t customers of the bank, had their confidence shaken in all corporate security. In order to work against their customer’s confidence being shaken, the bank need to make a commitment to make security of their customers’ data a higher priority. They should perform regular server maintenance and testing at least once a month, in order to prevent any similar oversights that may occur, and they should also make sure all customer data is encrypted so that even in the case of a breach the information is safe. Encrypting the information is also an excellent way to prevent against phishing scams. To ensure their customers’ don’t fall for the emails that have already gone out though, they could and should send out emails to everyone’s whose data was breached warning them against phishing scams and telling them the rules to identifying phishing emails. It’s going to be much harder to combat everyone’s faith in corporate security being shaken, but the best way to fight this is to go the route of Mega, the file hosting site. What Mega does with their files is very unique in that it doesn’t even give the company access to the encryption key. This formulas would have to be adjusted for different kinds of corporations like banks where the company needs the information sometimes, but they could make it so the customer would just share the encryption key, if and when the bank needed to access the info, and then the key would be changed. This could prove to be a bit of a hassle for the customer, but it could be an opt-in program for customers and businesses who need the extra security.
The Conclusion In 2014, America’s largest bank was breached and two-third of the population of the United States as well as seven million small business had their data stolen due to an outdated, and overlooked, server. This caused the customers’ confidence in their bank to be shaken, and meant that millions of customers’ data could now be used in phishing scams. It also meant that this breach set a new precedent for what can happen if a corporation’s security is subpar. The best way to make sure this doesn’t happen again is to implement regular server maintenance, as well as to encrypt customer data. It would be a decent idea to give the customers sole possession of the encryption key so they can’t be found on the bank’s servers.

Works Cited
"JPMorgan Chase Hacking Affects 76 Million Households." DealBook JPMorgan Chase Hacking Affects 76 Million Households Comments. N.p., 02 Oct. 2014. Web. 08 Dec. 2015. <http://dealbook.nytimes.com/2014/10/02/jpmorgan-discovers-further-cyber-security-issues/?_r=0>.
"Neglected Server Provided Entry for JPMorgan Hackers." DealBook Neglected Server Provided Entry for JPMorgan Hackers Comments. N.p., 22 Dec. 2014. Web. 08 Dec. 2015. <http://dealbook.nytimes.com/2014/12/22/entry-point-of-jpmorgan-data-breach-is-identified/>.
Wikipedia. Wikimedia Foundation, n.d. Web. 08 Dec. 2015. <https://en.wikipedia.org/wiki/2014_JPMorgan_Chase_data_breach>.
Wikipedia. Wikimedia Foundation, n.d. Web. 08 Dec. 2015. <https://en.wikipedia.org/wiki/JPMorgan_Chase>.