Oops! JP Morgan says 76 million households affected in largest ever data breach

[malaise]

http://www.theguardian.com/business/2014/oct/02/jp-morgan-76m-households-affected-data-breach
<snip>
JP Morgan Chase, one of the largest banks in the US, said on Thursday that a massive computer hack affected the accounts of 76 million households and about seven million small businesses, making it one of the largest of its kind ever discovered.

The attack was under way for a month before it was discovered in July, and when it was disclosed in August, the bank estimated that about one million accounts had been compromised. But the latest information revealed on Thursday showed the attack was vastly more serious than earlier thought.

The bank said financial information was not compromised and that there had been no breach of login information such as account or social security numbers, passwords or dates of birth. However names, email addresses, phone numbers and addresses of account holders were captured by hackers.

“As of such date, the firm continues not to have seen any unusual customer fraud related to this incident,” the bank said in a regulatory filing. It said customers would not be liable for unauthorized transactions on their account, so long as they promptly alerted the bank.

[JustAnotherGen]

1. It's not them - Chase itself

It's what can be done in other channels with that information.

I'm professionally friendly with what I consider my peers at our three main competitors. With the launch of the iPhone 6 - I believe we've all seen the impact. The info the fraudsters have is enough to compromise other accounts that are totally unrelated to Chase.

Now they have enough for a phishing scheme. And I think it's more than just the info in the article. Mothers maiden name, pets name, town father was born in.

So let's say someone has an account with a major retailer - they can probably get past the level two then call in for the assist.

This is a major screw up by Chase. Now it makes sense the call I received on Tuesday.

[NightWatcher]

2. my wife got her info stolen from this Chase breach

Someone had applied for unemployment using my wife's name (misspelled), social, and listed her current employer (who is listed on her mortgage forms with Chase). The way we know it is from this breach is because in her old mortgage account from Chase they misspelled her last name and it's the only place where this misspelling occurs. We refinanced one day with them and the application for unemployment was dated two days later. We've locked down everything, but Chase denied it was from a loss of info on their end. That was last month, now this comes out today.....