Risk

10/2/2015
05:15 PM
50%
50%

Scottrade Breach Hit 4.6 Million Customers, Began 2 Years Ago

Social Security numbers might have been exposed, but the main target appears to have been contact information.

Today, Scottrade Inc. announced a breach of 4.6 million customer contact information records (and possibly Social Security numbers), resulting from an attack that occurred between late 2013 and early 2014. 

Scottrade told customers in an email that it had "not seen any fraudulent activity as a result of this incident." However, the company also stated that it learned about the breach from the FBI, which was investigating a rash of breaches involving financial services firms. The company says it has no reason to believe its trading platforms or client funds were compromised, and that the focus appears to have been contact data, possibly to facilitate stock scams.

"A concerning lack of detective capabilities must not have been in place to have missed data exfiltration to the tune of 4.6 million records," says Stewart Draper, director of insider threat at Securonix. "The timeline specified was a particularly sensitive time in this sector with hacktivist and criminal groups regularly targeting financial companies. Federal authorities should not be the avenue with which companies are discovering they may have been breached.  In 2014 Scottrade was fined for failure to provide complete trade logs, blamed on an internal IT error from a migration. Accountability for these mistakes need to be taken at the highest levels of the organization to help drive awareness and improvement in security defense."

"The FBI is unlikely to explain in detail why notification of this breach took so long, but it's not uncommon for an ongoing investigation to delay notification so that criminals aren't tipped off," Tim Erlin, director of IT security and risk strategy at Tripwire.

A Scottrade representative told Wired that the FBI informed them of the breach in August but did ask them to withhold the information from customers until last Friday while they completed a part of the investigtion.

"Cyber criminals behave more like an infestation than the usual metaphor of a burglar," says Erlin. "Once they're inside, it takes more than a rolled-up newspaper to get rid of them."

"Scottrade customers are in the dark about exactly what was taken (the names and addresses were provided by Federal law enforcement), and don’t yet know where the data was taken from," says Trey Ford, global security strategist at Rapid7. "What we do know is that the data appears to have been taken 18-24 months ago. Few, if any, organizations store log data reaching that far back and it’s no wonder Scottrade cannot definitively state what data was taken for this reason."

See more at Scottrade's notice, at KrebsOnSecurity and Wired.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
prospecttoreza
0%
100%
prospecttoreza,
User Rank: Strategist
10/5/2015 | 9:54:38 AM
Scottrade breach
With all these breaches, it seems that there are more accounts stolen than people in US.

One could argue that by this time, there is almost nothing new to be stolen aside from info on kids just entering their credit lives.

So, what is the point of all these breaches? And do they even matter, if everyone is ultimately affected?
Blog Voyage
50%
50%
Blog Voyage,
User Rank: Strategist
10/3/2015 | 9:16:38 AM
Nice
What a drop ! Hoping the best for them
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: In Russia, application hangs YOU!
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...
CVE-2018-16515
PUBLISHED: 2018-09-18
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
CVE-2018-16794
PUBLISHED: 2018-09-18
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.