It is being reported that hackers have stolen the details of thousands of Citibank customers including their account details and personal information. As it turns out, this isn’t actually today’s news. This major security breach, resulting in the theft of personal information for nearly 200,000 Citibank customers, was actually stolen last month. You hadn’t heard? Neither have we, and that’s because Citibank chose to keep quiet about it until today.
Jun 9, 2011 8:55:00 PM
Apr 27, 2011 11:27:00 AM
Apr 6, 2011 1:16:00 PM
The email addresses leaked during the breach could be used to send targeted attacks to the customers of Epsilon's clients, which include a host of financial services providers such as Barclays Bank of Delaware, CapitalOne, Citibank and JPMorgan Chase. The banks are "freaking out" about the leak, says Avivah Liten, vice-president of security research for analyst firm Gartner.
"The attackers are going to use the records - that's what the banks are worried about," says Litan. "It might not even be focussed on the victim's bank accounts. They might just be interested in using the spearphishing attack to get on the desktop."
Friday, Epsilon warned its corporate customers that their client email addresses had been stolen by an attacker. While the company counts a number of major banks among its customers, other companies - such as Best Buy, Disney Destination, and Tivo - were also affected by the breach.
Epsilon says it continues to investigate the attack.
"The information that was obtained was limited to email addresses and/or customer names only," the company said in a statement. "A rigorous assessment determined that no other personally identifiable information associated with those names was at risk."
The attacks should convince companies to take a second, if not a third, look at their outsourced providers' security. While credit-card information comes with an industry mandated set of security standards, names and email addresses are not protected in the same way.
Click here for more information on this breach and who is at risk.