JPMorgan Chase data breach

On 2 October 2014, JPMorgan Chase — the largest bank in the United States — disclosed in a securities filing that attackers had compromised contact information for 76 million households and 7 million small businesses, totalling more than 83 million accounts. It remains one of the largest cyber intrusions ever into a U.S. financial institution.

What happened

The attackers gained their initial foothold around June 2014 by exploiting a server that had not been upgraded to require two-factor authentication. Most of JPMorgan's systems enforced multi-factor login, but this overlooked server let stolen credentials work with only a password. From there the intruders moved laterally and ultimately gained access to more than 90 servers inside the bank's network.

JPMorgan detected the intrusion in late July 2014 and contained it by mid-August, working with the FBI and U.S. Secret Service.

What was exposed

The stolen data was contact information rather than financial records:

• Names
• Email addresses
• Postal addresses
• Phone numbers
• Internal JPMorgan information about the affected users

The bank stated there was no evidence that account numbers, passwords, Social Security numbers, or dates of birth had been compromised, and no evidence of fraud tied directly to the breach.

Attribution and prosecution

The intrusion was later linked to a sprawling criminal enterprise. In November 2015, U.S. prosecutors in the Southern District of New York indicted Gery Shalon, Joshua Samuel Aaron and Ziv Orenstein, describing it as the largest known theft of customer data from a U.S. financial institution. The scheme spanned stock-manipulation ("pump-and-dump") operations, illegal online gambling, and payment processing, using stolen contact lists to market manipulated securities. The alleged hacker who carried out the intrusions, Andrei Tyurin, was extradited in 2018 and sentenced to 12 years in prison in 2021; Shalon forfeited hundreds of millions of dollars.

Impact

While no direct financial theft from customer accounts was attributed to the breach, the scale alarmed regulators and the public, coming amid a wave of major U.S. breaches. JPMorgan publicly committed to doubling its annual cybersecurity budget from roughly $250 million to $500 million over the following years.

Why it matters

The JPMorgan breach is the canonical lesson that a single overlooked control can undo an otherwise strong security program. One server missing two-factor authentication gave attackers access to more than 90 systems at the best-resourced bank in the country. It cemented MFA-everywhere as a baseline expectation for financial institutions and demonstrated how stolen contact data can fuel large-scale financial-fraud and securities-manipulation schemes rather than only identity theft.