The Bank: JPMorgan and the Silent Theft

On Thursday, the largest bank in the United States is telling a story that no bank wants to tell: it was robbed, and it did not know for weeks. JPMorgan Chase disclosed this week that hackers had broken into its systems, that the intrusion had been discovered in late July, and that the attackers had been inside since June. The bank said no money had been stolen, and it said the data of customers may have been accessed. The disclosure is the August 2014 story, and the story is the lesson: the biggest targets are not the ones that make the headlines, and the silence is the theft.

The Bank is the subject of this article: what happened to JPMorgan, how the breach was discovered, what was taken, and what it means for every institution that holds the data of millions. The story broke on Wednesday, August 27, and the bank confirmed the details the same day. This is the story of the breach, and the story is about the moment the best defended bank in America found the hole in its armor.

1. The Report

The report came from a news organization, and the news was the breach. Bloomberg reported on Wednesday that JPMorgan Chase, the largest bank in the United States by assets, had been the victim of a cyber attack, and the bank confirmed the report the same day. The bank said it had discovered the intrusion in late July, that the attackers had been inside its systems since June, and that it was working with the FBI and the Secret Service.

The report was the first public word, and the first public word was the shock. The bank was the most powerful financial institution in the country, the bank that had survived the financial crisis, the bank that spent a quarter of a billion dollars a year on security, and it had been breached. The report was the beginning, and the beginning was the question: if JPMorgan could be robbed, who was safe?

2. The Target

The target was the reason the breach mattered, and the reason was the size. JPMorgan Chase was the largest bank in the United States, with tens of millions of customers and trillions of dollars in assets. The bank was the center of the financial system, the institution that the other institutions depended on, and the center was the prize. The attackers had chosen the biggest target in the land, and the biggest target was the point.

The target was also the symbol. The bank that had been the model of stability, the bank that had weathered the crisis while others collapsed, was now the bank with the hole in its defenses. The breach was the proof that no institution was too big to hack, and the proof was the warning. The target was the story, and the story was the scale.

3. The Silence

The silence was the most disturbing part of the story, and the silence was the months. The attackers had been inside the bank's systems since June, and the bank had discovered the intrusion in late July, and the weeks in between were the weeks when the data could have been flowing out. The bank's security team was among the best in the world, and the best in the world had missed the intruders for weeks. The silence was the gap, and the gap was the failure.

The silence was also the pattern of the modern bank robbery. The thieves did not need masks and guns; they needed a way in, and they had found it, and the finding had been silent. The bank had been watching the perimeter, and the attackers had moved inside, and the inside was where the data lived. The silence was the method, and the method was the lesson.

4. The Discovery

The discovery was the small mercy, and the mercy was the investigation. The bank said it had discovered the intrusion with the help of the FBI, after the government had tipped the bank to a broader hacking campaign that targeted financial institutions. The discovery was not the result of the bank's own monitoring; it was the result of a tip, and the tip was the difference between the silent theft and the known breach.

The discovery was also the beginning of the questions. The bank did not know, at the time of the disclosure, the full scope of the attack, and the unknown was the fear. The investigators would trace the path of the attackers, and the tracing would take months. The discovery was the beginning of the answer, and the answer was the future of the story. The discovery was the moment the silence ended, and the ending was the start.

5. The Data

The data was the treasure, and the treasure was the question. The bank said that no account numbers had been stolen, and no money had been lost, and the statements were the reassurance. The bank also said that the attackers may have accessed the personal information of customers: names, addresses, email addresses, and phone numbers, the data that the bank collected from tens of millions of people. The data was the value, and the value was the threat.

The data was also the weapon of the future. The names and the addresses were the ingredients of the phishing attacks, the identity theft, and the fraud that would follow the breach. The bank that said the money was safe was also saying that the customers' information was in the wind, and the wind was the danger. The data was the story, and the story was the risk.

6. The Defense

The defense was the irony, and the irony was the spending. JPMorgan had been spending about a quarter of a billion dollars a year on cybersecurity, and the spending was the proof of the commitment, and the spending had not stopped the attackers. The bank had the budget, the talent, and the attention of the board, and the bank had still been breached. The defense was the question, and the question was the doubt.

The defense was also the lesson in the limits of the budget. The security was not a matter of spending alone; it was a matter of the gaps, the overlooked systems, the forgotten servers, the human errors, and the gaps were where the attackers lived. The bank that spent the most had been beaten by the attackers who found the crack. The defense was the warning, and the warning was the humility.

7. The Lesson

The lesson of the breach was about the nature of the modern target, and the nature was the data. The bank robbers of the past wanted the cash, and the bank robbers of the present wanted the information, and the information was worth more than the cash in the long run. The bank that protected the vault but lost the data had lost the thing that mattered, and the loss was the lesson.

The lesson was also about the detection, and the detection was the weakness. The bank had the defenses, and the defenses had not seen the attackers, and the seeing had come from the outside. The institutions that waited for the tip, that relied on the government, that discovered the breach after the fact, were the institutions that would be robbed again. The lesson was that the detection was the defense, and the detection was the gap. The lesson was the silence, and the silence was the enemy.

8. The Future

The future of the story would be the investigation, and the investigation would take months. The attackers would be traced, the scope would be measured, and the bank would tell the customers what it knew, and the telling would be the slow reveal. The regulators would ask their questions, the congress would hold its hearings, and the industry would study the breach. The future was the aftermath, and the aftermath was the learning.

The future was also the lesson in the making. The breach would be the case study of the year, the proof that the biggest institutions were the biggest targets, and the proof would change the industry. The banks would spend more, the regulators would demand more, and the attackers would adapt. The breach is the August 2014 story, and the story is the lesson: the biggest targets are not the ones that make the headlines, and the silence is the theft. The bank was robbed, and the robbery was silent, and the silence was the story. The security teams of the world's institutions are reading the coverage and checking their own networks, and the checking is the ripple. The bank that was robbed will rebuild, and the rebuilding will be the template for the others. The next attack will come, and the next attack will find the institutions that learned from the silence. The regulators will demand more, and the congress will ask the questions, and the industry will harden the defenses, and the hardening is the legacy of the breach. The bank that was robbed will rebuild, and the rebuilding will be the template for the others, and the template is the lesson. The next attack will come, and the next attack will find the institutions that learned from the silence of this summer.

Tags

#engineering #technology