The Hongkong and Shanghai Banking Corporation (HSBC) has suffered a data breach in which unknown hackers have accessed personal and financial data of its customers.
The data breach, according to the notification from HSBC, took between October 4, 2018, and October 14, 2018. Upon detecting the breach, authorities suspended online access to prevent further unauthorized entry of user account.
However, after investigation, it was revealed that hackers managed to access customers’ full name, phone number, date of birth, email address, mailing address, bank account number, account balance, account type, payee account information, transaction and statement history.
“You may have received a call or email from us so we could help you change your online banking credentials and access your account,” said the notification.
Furthermore, the notification states that to safeguard its customers from future cyber attacks; the bank has now enhanced its authentication process for HSBC Personal Internet Banking with an extra layer of security.
Moreover, targeted customers are being offered with a complimentary subscription to Identity Guard, a credit monitoring and identity theft protection service. “Identity Guard not only provides essential monitoring and protection of credit data, but also alerts you to certain activities that could indicate potential identity theft,” explained HSBC.
Stephen Moore, Chief Security Strategist at Exabeam commented on the data breach and told HackRead.com that:
“The most seasoned and well-resourced security teams can be easily overwhelmed by the volume of organizational alerts they receive in a day. That complexity, when combined with the inherent difficulties of detecting credential-based attacks, because the attackers are impersonating legitimate users, creates an environment that lacks control and trust. In this case, the security incident was likely the result of malicious actors using previously collected or breached login data to access bank accounts.”
“To protect against these types of attacks, organizations must shift the enterprise security strategy. To remediate incidents involving user credentials and respond to adversaries, the key is to move fast and consider an approach that is closely aligned with monitoring user behavior–to provide the necessary visibility needed to restore trust, and react in real time, to protect user accounts. This should include the ability to detect, using behavioral characteristics, when events have occurred – especially when it comes to client/member/customer-facing incidents,” explained Moore.
This is not the first time when HSBC has come under a cyber attack. In January 2016, the HSBC suffered a series of massive DDoS attacks which affected the servers on one of the most important days that is the payday. In July 2016, the OurMine hacking group conducted DDoS attacks on HSBC forcing its websites in the UK and the USA to go offline.
