Risk

10/2/2015
05:15 PM
50%
50%

Scottrade Breach Hit 4.6 Million Customers, Began 2 Years Ago

Social Security numbers might have been exposed, but the main target appears to have been contact information.

Today, Scottrade Inc. announced a breach of 4.6 million customer contact information records (and possibly Social Security numbers), resulting from an attack that occurred between late 2013 and early 2014. 

Scottrade told customers in an email that it had "not seen any fraudulent activity as a result of this incident." However, the company also stated that it learned about the breach from the FBI, which was investigating a rash of breaches involving financial services firms. The company says it has no reason to believe its trading platforms or client funds were compromised, and that the focus appears to have been contact data, possibly to facilitate stock scams.

"A concerning lack of detective capabilities must not have been in place to have missed data exfiltration to the tune of 4.6 million records," says Stewart Draper, director of insider threat at Securonix. "The timeline specified was a particularly sensitive time in this sector with hacktivist and criminal groups regularly targeting financial companies. Federal authorities should not be the avenue with which companies are discovering they may have been breached.  In 2014 Scottrade was fined for failure to provide complete trade logs, blamed on an internal IT error from a migration. Accountability for these mistakes need to be taken at the highest levels of the organization to help drive awareness and improvement in security defense."

"The FBI is unlikely to explain in detail why notification of this breach took so long, but it's not uncommon for an ongoing investigation to delay notification so that criminals aren't tipped off," Tim Erlin, director of IT security and risk strategy at Tripwire.

A Scottrade representative told Wired that the FBI informed them of the breach in August but did ask them to withhold the information from customers until last Friday while they completed a part of the investigtion.

"Cyber criminals behave more like an infestation than the usual metaphor of a burglar," says Erlin. "Once they're inside, it takes more than a rolled-up newspaper to get rid of them."

"Scottrade customers are in the dark about exactly what was taken (the names and addresses were provided by Federal law enforcement), and don’t yet know where the data was taken from," says Trey Ford, global security strategist at Rapid7. "What we do know is that the data appears to have been taken 18-24 months ago. Few, if any, organizations store log data reaching that far back and it’s no wonder Scottrade cannot definitively state what data was taken for this reason."

See more at Scottrade's notice, at KrebsOnSecurity and Wired.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
prospecttoreza
0%
100%
prospecttoreza,
User Rank: Strategist
10/5/2015 | 9:54:38 AM
Scottrade breach
With all these breaches, it seems that there are more accounts stolen than people in US.

One could argue that by this time, there is almost nothing new to be stolen aside from info on kids just entering their credit lives.

So, what is the point of all these breaches? And do they even matter, if everyone is ultimately affected?
Blog Voyage
50%
50%
Blog Voyage,
User Rank: Strategist
10/3/2015 | 9:16:38 AM
Nice
What a drop ! Hoping the best for them
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-7682
PUBLISHED: 2018-06-22
Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains.
CVE-2018-12689
PUBLISHED: 2018-06-22
phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login panel.
CVE-2018-12538
PUBLISHED: 2018-06-22
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage...
CVE-2018-12684
PUBLISHED: 2018-06-22
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
CVE-2018-12687
PUBLISHED: 2018-06-22
tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.