JPMorgan Chase discovered an intrusion in late July 2014 and did not fully halt it until mid-August; the bank disclosed the breach in September 2014. Attackers obtained a list of the bank’s applications and programs, used it to identify vulnerabilities, and accessed names, email and postal addresses, and telephone numbers associated with approximately 76 million households and 7 million small businesses—more than 83 million accounts. JPMorgan said financial credentials, Social Security numbers, and passwords were not compromised, but the exposed contact data created substantial phishing and identity-abuse risks.
The campaign also targeted at least nine other financial institutions, including Citigroup, HSBC, E*Trade, Regions Financial, and ADP; investigators believed Fidelity Investments was the only other company confirmed at the time to have lost data. In November 2015, U.S. prosecutors indicted four hackers on 23 counts involving more than 100 million customers. Gery Shalon pleaded guilty in 2017 and agreed to forfeit more than $400 million; Andrei Tyurin was extradited in 2018 and sentenced to 12 years in prison in 2021. JPMorgan said it would double annual security spending from $250 million in 2014 to $500 million over five years and tighten access controls.
