June 12, 2011

Hackers strike at major firms

NEW YORK - Citigroup Inc. has become the latest victim in a string of high-profile data thefts by hackers targeting some of the world's best-known companies.

The New York bank said Thursday that about 200,000 Citibank credit-card customers in North America had their names, account numbers and e-mail addresses stolen by hackers who broke into Citi's online account site.

The breach comes after data attacks in recent weeks have struck at companies including Internet search leader Google Inc., defense contractor Lockheed Martin Corp. and media and electronics company Sony Corp.

Citigroup said it discovered that account information for about 1 percent of its credit-card customers had been viewed by hackers. Citi has more than 21 million credit-card customers in North America, according to its 2010 annual report.

The bank, which discovered the problem during routine monitoring, didn't say exactly how many accounts were breached.

Citi said it was contacting those customers.

The bank said hackers weren't able to gain access to Social Security numbers, birth dates, card-expiration dates or card-security codes. That kind of information often leads to identity theft, where cybercriminals empty bank accounts and apply for multiple credit cards. That can debilitate the finances and credit of victims.

Citi customers could still be vulnerable to other problems. Details about their bank accounts and financial information linked to them could be acquired using the e-mail information and account numbers that hackers stole.

Federal regulators have taken notice and are asking banks to improve security.

"Both banks and regulators must remain vigilant," said Sheila Bair, chair of the Federal Deposit Insurance Corp. She said federal agencies are developing new rules to push banks to enhance online account access.

The Citi incident is only the latest data breach at a major company.

• On June 1, Google said that the personal Gmail accounts of several hundred people, including government officials and military personnel, had been breached.

• On May 30, broadcaster PBS confirmed that hackers cracked the network's website and posted a phony story claiming dead rapper Tupac Shakur was alive in New Zealand.

• On May 28, Lockheed Martin said it had detected a "significant and tenacious attack" against its computer networks. The company said it took swift action to protect the network and the systems remain secure.

• In April, Sony's PlayStation Network was shut down after a security breach that affected more than 100 million online accounts.

• Also in April, hackers penetrated a network operated by a data-marketing firm Epsilon, which handles e-mail communications for companies such as Best Buy and Target.

The number of data breaches in the last two months sets a "high watermark," said John Ottman, CEO of Application Security Inc., a New York-based company that specializes in securing databases, the big repositories companies use to organize account information.

"Attackers have realized that most organizations have not properly protected databases," Ottman said.

Cyberattackers have a variety of less-dangerous motivations, from mischief to online activism. For example, a group identifying itself as LulzSec claimed credit for the fake PBS article calling it retaliation for a documentary about WikiLeaks.

But often such data breaches are an attempt to steal personal data, which is likely the case with Citi. Hackers also will pose as legitimate companies in a tactic known as phishing, where they try to get users to supply additional information like Social Security numbers and e-mail or bank passwords to get access to their financial information.

The fact that the Citi hackers only got a few pieces of personal data on customers may limit what crooks can do with the information, said Susan Grant, director of consumer protection at Consumer Federation of America, a consumer-advocacy group.

"But any ID theft is worrisome for consumers," Grant said. She believes companies are responsible for protecting their customers' information from internal and external abuse.

In an e-mailed statement, Sean Kevelighan, a spokesman for Citi said the bank is contacting affected customers and enhancing procedures to prevent a similar security breach.

"For the security of these customers, we are not disclosing further details," he said.

by Pallavi Gogoi and Kelvin Chan Associated Press Jun. 11, 2011 12:00 AM

Hackers strike at major firms

No comments:

Post a Comment


Crave: The Gadget Blog

PCWorld Latest Technology News

CNET TV: Laptops

Blog Archive

Recent Comments