Search This Blog

Powered by Blogger.

Blog Archive

Labels

Showing posts with label Banking System attacked. Show all posts

Ukraine Hacks ATMs Across Russia in Massive Cyberattack



On July 23, 2024, a massive cyberattack launched by Ukrainian hackers targeted Russian financial institutions, disrupting ATM services across the country. According to a source within Ukrainian intelligence, the attack is “gaining momentum” as it continues to cripple banking services. By July 27, the fifth day of the cyberattack, customers of several prominent Russian banks found themselves unable to withdraw cash. When attempting to use ATMs, their debit and credit cards were immediately blocked, leaving them stranded without access to their funds. 

The intelligence source, who provided written comments to the Kyiv Post, indicated that the attack had affected numerous banks, including Dom.RF, VTB Bank, Alfa-Bank, Sberbank, Raiffeisen Bank, RSHB Bank, Rosbank, Gazprombank, Tinkoff Bank, and iBank. The widespread disruption has caused significant inconvenience for customers and highlighted vulnerabilities within Russia’s financial infrastructure. The source in Ukrainian intelligence mocked the situation, suggesting that the Kremlin’s long-desired “import substitution” might now include reverting to wooden abacuses, paper savings books, and cave paintings for accounting. 

This remark underscores the scale of the disruption and the potential for outdated methods to replace modern financial technologies temporarily. The cyberattack represents a significant escalation in the ongoing cyber conflict between Ukraine and Russia. While cyberattacks have been frequent on both sides, the targeting of ATM services and the subsequent blocking of debit and credit cards mark a notable shift towards directly impacting ordinary citizens’ daily lives. This attack not only disrupts financial transactions but also instills a sense of insecurity and distrust in the reliability of banking systems. 

The list of affected banks reads like a who’s who of Russia’s financial sector, including both state-owned and private institutions. The inability to withdraw cash from ATMs during the attack has put pressure on these banks to quickly resolve the issues and restore normal services to their customers. However, the continued nature of the cyberattack suggests that solutions may not be forthcoming in the immediate future. The Ukrainian hackers’ ability to sustain such a large-scale cyberattack over several days indicates a high level of coordination and technical expertise. It also raises questions about the preparedness and resilience of Russian banks’ cybersecurity measures. 

As the attack progresses, it is likely that both sides will escalate their cyber capabilities, leading to further disruptions and countermeasures. The broader implications of this cyberattack are significant. It highlights the increasingly blurred lines between cyber warfare and traditional warfare, where digital attacks can cause real-world consequences. The disruption of banking services serves as a stark reminder of how dependent modern societies are on digital infrastructure and the potential vulnerabilities that come with it. 

In response to the ongoing cyberattack, Russian banks will need to bolster their cybersecurity defenses and develop contingency plans to mitigate the impact of such attacks in the future. Additionally, international cooperation and dialogue on cybersecurity norms and regulations will be crucial in preventing and responding to similar incidents on a global scale. As the situation develops, the cyber conflict between Ukraine and Russia will likely continue to evolve, with both sides seeking to leverage their technological capabilities to gain an advantage. The ongoing cyberattack on Russian ATMs is a clear demonstration of the disruptive potential of cyber warfare and the need for robust cybersecurity measures to protect critical infrastructure.

First Horizon Bank Online Accounts Hacked to Steal Customers’ Funds

The financial institution, First Horizon Corporation reported that earlier this month some of its customers’ online banking accounts have been breached by unidentified cybercriminals.

‘First Horizon’ is a regional financial company that provides facilities including capital market, wealth management services and offers banking services in a region with $84 billion in assets. 

Additionally, the institution also operates its company's banking subsidiary; hundreds of banks are located in 12 states across the Southeast region. 

According to the company, the attack came into light in the middle of April 2021 and as per the reports it only impacted limited customers’ accounts. Whilst investigation was going on, it was discovered that the unidentified cybercriminals could possibly get access to customers' online bank accounts with the help of previously stolen sensitive information and by trespassing third-party software. 

"Using the credentials and exploiting a vulnerability in third-party security software, the unauthorized party gained unauthorized access to under 200 online customer bank accounts," First Horizon added in an 8-K form filed with the U.S. Securities and Exchange Commission (SEC) on Wednesday. 

It is also being reported that the threat actors were also able to get access to the customers’ credentials kept in the infringement accounts and fetch reserve money from some of them before the attack was being discovered. 

However, the firm reported that they "fraudulently obtained an aggregate of less than $1 million from some of those accounts." 

The institution, after discovering the attack, informed the affected customers while also notifying the data management department and law enforcement firms. Furthermore, for security purposes, it also opened new online banking accounts for its directly affected customers. 

The vulnerability exploited by the attackers, that was present in the system, has also been taken care of by the company, they have also successfully reset the passwords of the affected accounts. 

In this regard, lastly, the first Horizon concluded by saying that, "Based on its ongoing assessment of the incident to date, the Company does not believe that this event will have a material adverse effect on its business, results of operations or financial condition." However, at present, the firm did not report anything on the exploited third-party software.