Citigroup confirmed that attackers recently breached its systems,
resulting in the exposure of customers' personal details.
"During routine monitoring, we recently discovered unauthorized
access to Citi's Account Online," said a Citi spokesperson via
email. "A limited number--roughly 1 percent--of Citi North America
bankcard customers' account information ... was viewed." According
to the company's most recent annual report, it has 21 million North
American customers, meaning that approximately 210,000 customers
had their details stolen during the attack.
The exposed account information included names, account numbers,
email addresses, and contact details. But according to Citi, "the
customer's social security number, date of birth, card expiration
date, and card security code (CVV) were not compromised."
Even so, "customers affected by this incident should be on high
alert for scams, phishing, and phone calls purporting to be from
Citibank and their subsidiaries," said Chester Wisniewski, a senior
security advisor at Sophos Canada, in a blog post.
Citi said that it's contacting affected customers, and that it's
already "implemented enhanced procedures to prevent a recurrence of
this type of event," although for security purposes, it declined to
detail those enhancements.
Citi apparently discovered the Citi Account Online breach in May,
during routine systems maintenance. But the breach didn't come to
light until Citi responded to questioning by the Financial
Times.
Citigroup is the country's third-largest bank, after Bank of
America and J.P. Morgan Chase. The Citi breach follows recent
attacks against Sony, which in the past two months has seen its
websites breached 17 times, PBS, Honda Canada, as well as EMC's RSA
division. EMC this week confirmed that attackers used stolen
SecurID two-factor authentication system information to attempt to
hack into the website of defense contractor Lockheed Martin, which
said that it successfully repelled the attack. Other defense
contractors have also reportedly been targeted by similar
attacks.
How widespread are data braches? No one knows for sure. Currently,
there's no national data breach law, although about 15 states do
require companies to inform residents when their information may
have been compromised. The resulting breach notification letters
are a primary source of information for identifying when businesses
have suffered data breaches.
But the House and Senate have been taking a closer look at data
breach notifications, and especially the speed with which companies
notify affected consumers. Last week, the House Energy &
Commerce Committee Subcommittee on Commerce, Manufacturing, and
Trade, asked representatives from Sony, as well as Epsilon (which
was breached in March), for detailed timelines about how quickly
they responded to the breach and notified affected customers.
Meanwhile, last month, a group of senators called on the Securities
and Exchange Commission to begin requiring public companies to
disclose all privacy or security exposures--in other words,
breaches.
Now, government agencies are also getting involved. On Wednesday,
the Department of Commerce's Internet Policy Task Force issued a
report that called for the department to create new incentives for
companies to improve their information security practices.
According to a blog post from Bret Cohen, an attorney at Hogan
Lovells, such incentives "would include continuing to advocate for
the adoption of a national breach notification law, facilitating
the sharing of information about security breaches as they occur,
and evaluating other public policy tools that can be used to
promote cybersecurity best practices--such as liability protection
and reducing 'cyberinsurance' premiums for companies that adopt
best practices and openly share details about cyberattacks."