UniCredit Bank Says 400,000 Accounts Were Hacked, Exposing Data

[tregs_beales]

UniCredit SpA said hackers accessed about 400,000 client bank accounts in Italy, taking biographical and loan data in one of the biggest breaches in Europe to date.


The incidents occurred in September and October of 2016 and June to July of this year, the bank said on Wednesday in an emailed statement. Unauthorized access was gained through an Italian third-party provider to some customer data related to personal loans, with the lender saying IBAN numbers and other personal data may also have been reached. A spokesman declined to identify the third party involved.
Banks are boosting cyber-defense budgets and hiring former intelligence and law enforcement officials to build up defenses against hackers as lenders open their networks to connect with new money-management apps and other fintech offerings. In the U.K., banks such as Barclays Plc and Deutsche Bank AG have joined forces with law enforcement in a unit called the Cyber Defence Alliance.
The most recent attacks were detected between Monday and Tuesday and led to the discovery of the incidents that took place last year, two people familiar with the matter said, asking not to be identified discussing a possible criminal matter.
“I expect that this case will lead to all Italian banks reviewing their IT systems,” said Francesco Confuorti, chief executive officer of Advantage Financial SA, a Milan-based investment firm. “This is the first attack targeting an Italian bank and confirms that IT systems, particularly in Italy, need massive investment to avoid a loss of confidence.”
Banking industry leaders are worried about more than the theft of customers’ data or money. Cybercriminals might also damage account databases and render them unusable, said Becky Pinkard, vice president of service delivery and intelligence at Digital Shadows Ltd., a London-based cyberdefense firm.
"Banks are justified in their fear of corrupted data," Pinkard said. "Attackers could harm the bank by adding or subtracting a zero to every balance, or even deleting entire accounts."

Read More here