Citigroup Confirms Hackers Stole Customer Data

Names, account numbers, email addresses, and contact details for more than 200,000 customers stolen in newest attack.

(click image for larger view)
Slideshow: 10 Massive Security Breaches
Citigroup on Thursday confirmed that attackers recently breached its systems, resulting in the exposure of customers personal details.
During routine monitoring, we recently discovered unauthorized access to Citis Account Online, said a Citi spokesperson via email. A limited number--roughly 1%--of Citi North America bankcard customers account information ... was viewed. According to the companys most recent annual report, it has 21 million North American customers, meaning that approximately 210,000 customers had their details stolen during the attack.
The exposed account information included names, account numbers, email addresses, and contact details. But according to Citi, the customers social security number, date of birth, card expiration date, and card security code (CVV) were not compromised.
Even so, customers affected by this incident should be on high alert for scams, phishing, and phone calls purporting to be from Citibank and their subsidiaries, said Chester Wisniewski, a senior security advisor at Sophos Canada, in a
blog post
.
Citi said that its contacting affected customers, and that its already implemented enhanced procedures to prevent a recurrence of this type of event, although for security purposes, it declined to detail those enhancements.
Citi apparently discovered the Citi Account Online breach in May, during routine systems maintenance. But the breach didnt come to light until Citi responded to
questioning
by the
Financial Times
on Wednesday.
Citigroup is the countrys third-largest bank, after Bank of America and J.P. Morgan Chase. The Citi breach follows recent attacks
against Sony
, which in the past two months has seen its websites breached 17 times,
PBS
,
Honda Canada
, as well as EMCs
RSA division
. EMC this week confirmed that attackers used stolen SecurID two-factor authentication system information to attempt to hack into the website of defense contractor
Lockheed Martin
, which said that it successfully repelled the attack. Other defense contractors have also reportedly been targeted by similar attacks.
How widespread are data braches? No one knows for sure. Currently, theres no national data breach law, although about 15 states do require companies to inform residents when their information may have been compromised. The resulting breach notification letters are a primary source of information for identifying when businesses have suffered data breaches.
But the House and Senate have been taking a closer look at data breach notifications, and especially the speed with which companies notify affected consumers. Last week, the House Energy & Commerce Committee Subcommittee on Commerce, Manufacturing, and Trade, asked representatives from Sony, as well as
Epsilon
(which was breached in March), for detailed timelines about how quickly they responded to the breach and notified affected customers.
Meanwhile, last month, a group of senators called on the Securities and Exchange Commission to begin requiring public companies to
disclose all privacy or security exposures
--in other words, breaches.
Now, government agencies are also getting involved. On Wednesday, the Department of Commerces Internet Policy Task Force
issued a report
that called for the department to create new incentives for companies to improve their information security practices.
According to a
blog post
from Bret Cohen, an attorney at Hogan Lovells, such incentives would include continuing to advocate for the adoption of a national breach notification law, facilitating the sharing of information about security breaches as they occur, and evaluating other public policy tools that can be used to promote cybersecurity best practices--such as liability protection and reducing cyberinsurance premiums for companies that adopt best practices and openly share details about cyberattacks.
In this new Tech Center report, we profile five database breaches--and extract the lessons to be learned from each. Plus: A rundown of six technologies to reduce your risk.
Download it here
(registration required).

Last News
▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Citigroup Confirms Hackers Stole Customer Data