JPMorgan's 2014 breach hit 76M households — and the bank didn't detect it for months

In August 2014, JPMorgan Chase, the largest bank in the US, disclosed that hackers had stolen data on approximately 76 million households and 7 million small businesses. The stolen data included names, addresses, phone numbers and email addresses.

The breach had begun in June 2014 and went undetected for approximately two months. The hackers gained access through a compromised employee account and exploited vulnerabilities in JPMorgan's network. The bank's $250 million annual cybersecurity budget was not sufficient to prevent the breach.

The case illustrated that even the most well-funded cybersecurity programs can be breached through basic vulnerabilities (compromised credentials, unpatched servers), and that the size of the security budget is less important than the quality of the implementation. JPMorgan's $250M budget was the largest in the industry; the breach was caused by a failure to apply basic security hygiene.