2014 JPMorgan Chase data breach
| Industry | Financial services |
|---|---|
| Founded | 1799 |
| Headquarters | New York City , United States |
| Products | Banking, financial services |
The 2014 JPMorgan Chase data breach represented a significant cyberattack against the American financial institution JPMorgan Chase, compromising information associated with more than 83 million accounts—comprising 76 million households (approximately two-thirds of all U.S. households) and 7 million small business accounts. This incident stands as one of the largest data breaches ever recorded and ranks among the most severe compromises of a major U.S. corporation’s information infrastructure.
The cyberattack
Revealed publicly in September 2014, the intrusion was initially identified by the bank’s cybersecurity team in late July but was not completely contained until mid-August. JPMorgan Chase assured that sensitive financial data and login credentials, including social security numbers and passwords, remained secure; nevertheless, attackers accessed customers’ names, email addresses, mailing addresses, and phone numbers, raising concerns regarding potential phishing schemes. The perpetrators exploited a catalog of JPMorgan’s software applications to detect weaknesses and gain unauthorized entry.
Alongside JPMorgan Chase, nine additional major financial entities were targeted during this cyber incident. By October 2014, Fidelity Investments was the only other firm confirmed to have suffered data theft, though investigators noted attempted breaches on networks of companies such as Citigroup, HSBC Holdings, E*Trade, Regions Financial Corporation, and payroll service provider Automatic Data Processing (ADP).
This breach took place during a period when consumer confidence in digital security was already vulnerable due to recent cyberattacks in the retail industry.
Indictments and extradition
In November 2015, U.S. federal authorities charged four individuals in connection with the extensive cyber fraud. Two Israeli nationals, Gery Shalon and Ziv Orenstein, were apprehended in Israel and extradited to the United States in 2016, as confirmed by Israel’s Justice Ministry. American hacker Joshua Samuel Aaron also faced indictment. The accused confronted 23 counts related to computer hacking that impacted over 100 million customers. In 2017, Shalon admitted guilt on all charges and consented to forfeit assets exceeding $400 million. Orenstein avoided further incarceration in 2020 after collaborating with law enforcement agencies. Aaron was detained in December 2016. A fourth suspect, Andrei Tyurin (also spelled Andrey Tiurin), was extradited from Georgia in 2018 and received a 12-year prison sentence in 2021.
JPMorgan Chase's Response
In response to the breach, JPMorgan Chase increased its annual cybersecurity investment from $250 million in 2014 to $500 million over a five-year span. Additionally, the company introduced software enhancements aimed at curbing unauthorized access and strengthening protection of sensitive customer information.