The news last week that 76 million household customers and 7 million business customers of JPMorgan may have had their personal information compromised was shocking enough. Now it is being widely reported, including from the NY Times, that the breach was part of a campaign against US interests by Russia.
Russia is well known as the home of many criminal hacking operations. While the Russian government may look the other way they are not generally assumed to be actively involved with them. According to the Times, a Russian hacker group behind the JPMorgan Chase breach is believed “to have at least loose connections to officials in the Russian government”.
The Times reports that previously undisclosed breaches at nine major financial institutions have been traced to this same hacker group.
Relations between the US and Russia have been strained, to say the least, over Russia’s efforts to annex portions of Ukraine and other international conflicts such as the Syrian civil war. A wave of high profile breaches may be, in part, a Russian response to economic sanctions imposed by the United States and its European allies this year.
The Target cardholder data breach last year, and numerous other point-of-sale breaches recently, have been traced to hackers operating out of Russia. Most analysts and law enforcement have assumed that these breaches were solely for financial gain. The possibility that they have been actively aided and abetted by Russian authorities must now be considered a real possibility.
JPMorgan Chase has emphasized that the data stolen, while valuable to criminal hackers, does not include social security and account data that is most prized by criminals for committing financial fraud. That fact itself, however, has fueled speculation that the motives in the case might not be purely criminal, and that the size and scope of the breach might have been intended to send a message.
If JPMorgan Chase could suffer such a massive breach, is anyone safe?
