Banks are hacked twice in 8 months and about 300 million yen is stolen

The National Bank of Blacksburg in the state of Virginia in the United States was invaded twice by a hacker in a short period of 8 months, and a total of 2.4 million dollars (about 270 million yen) was illegally drawn out Occurred. At the time of writing of the article, the bank has filed suit against the insurance company on the assumption that the loss compensation amount for hacking damage is not sufficient.

Hackers Breached Virginia Bank Twice in Eight Months, Stole $ 2.4 M - Krebs on Security
https://krebsonsecurity.com/2018/07/hackers-breached-virginia-bank-twice-in-eight-months-stole-2-4m/

According to National Bank of Blacksburg, in May 2016 employees of the bank received a phishing e-mail, and the first damage was caused because it opened easily. After this e-mail installed malware on employee's PC, the hacker invades this employee's PC. And a hacker who broke into an employee's PC started hacking to another computer.

Computers hacked by hackers are used to access the STAR network which handles debit card transactions and so on and it seems that they also had the function of managing their bank accounts

By manipulating this computer during the weekend when employees are not working, hackers have changed the security functions such as the customer's PIN, the maximum amount of withdrawal per day, and the restriction on the use of David cards. I stealed more than 569,000 dollars (about 63 million yen) from the bank.

The National Bank of Blacksburg, who knew the hacking damage at the end of the week, called cybersecurity experts and investigated the incident. According to security experts, it seems that hacking was done from the IP address of Russia. As a measure to prevent recurrence to prevent hacking damage in the future, Bank carried out strengthening the security of the system.

However, after eight months since the official of the National Bank of Blacksburg opened a phishing e-mail in January 2017, the same incident will recur. In the second incident, we did not intrude into the STAR network, but the Navigator system of the bank was hacked and more than 1.8 million dollars (about 200 million yen) was stolen.

Security damage caused by hacking etc. can be suppressed by strengthening the security of the system. However, as a countermeasure against phishing e-mail, which is the origin of the problem, concerns security awareness of each employee, this case is a good example in the sense that "security education for employees is important".

The lawsuit that National Bank of Blacksburg is raising against the insurance company said that the upper limit of the insurance company's loss compensation against the second hacking damage was $ 250,000 (about 28 million yen) It is starting from the beginning that what is far below it.