> series: anatomy_of_a_breach —— part: 067 —— target: jp_morgan_chase —— households: 76,000,000 —— security_budget: $250,000,000<span class="cursor-blink">_</span>_
In October 2014, JP Morgan Chase disclosed that attackers had breached its systems during the summer of 2014, compromising data on 76 million households and 7 million small businesses — making it the largest breach of a US financial institution at the time. The stolen data included names, addresses, phone numbers, email addresses, and internal JP Morgan information about account types. JP Morgan stated that no financial data (account numbers, passwords, Social Security numbers) was stolen, and that there was no evidence of fraud resulting from the breach.
The breach was particularly striking because JP Morgan spent approximately $250 million annually on cybersecurity and employed over 1,000 security staff — one of the largest security operations in the financial sector. The attackers had gained initial access through a compromised employee's credentials and exploited a server that had not been upgraded to two-factor authentication — a single server in an otherwise well-protected infrastructure. The breach persisted for approximately two months before JP Morgan's security team detected it, demonstrating that even the most well-resourced security operations have gaps.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe JP Morgan breach is the most compelling evidence in this entire series that security is determined by its weakest point, not its strongest. JP Morgan had enterprise-grade security across most of its infrastructure — but one server had not been upgraded to require two-factor authentication. The attackers found that server, used compromised credentials to access it, and from there moved laterally into systems containing 76 million customer records.
The JP Morgan breach teaches that security controls must be applied universally — every server, every access point, every account. A single exception creates the gap that attackers will find. Cyber Essentials certification enforces this universality by requiring MFA, patching, and access controls across the entire in-scope estate. Our penetration testing validates that controls are uniformly applied. Vulnerability scanning identifies the servers that have been missed. SOC in a Box for Financial Services monitors for the credential compromise and lateral movement that defined the JP Morgan attack. And UK Cyber Defence provides incident response when a breach is detected.
Our <a href="/penetration-testing">penetration testing</a> finds the gaps. <a href="/vulnerability-scanning">Vulnerability scanning</a> identifies the servers you missed. <a href="/cyber-essentials">Cyber Essentials</a> mandates universal MFA. Because 99% coverage leaves exactly the gap that attackers exploit.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call