Yahoo confirms Shellshock-targeting attackers hacked into three of its servers, but claims they didn't exploit Bash flaws. Meanwhile, Lycos denies it's been breached and WinZip isn't responding directly to a report that it was hacked.
The hackers who breached JPMorgan Chase also infiltrated about nine other financial institutions, and may be operating from Russia, according to one news report. But security experts caution against jumping to conclusions over attackers' identities or motives.
Leading this week's industry news roundup, KPMG acquires assets of Qubera Solutions, which provides identity and access management services, while Palo Alto Networks launches an endpoint protection solution.
JPMorgan Chase has confirmed that 76 million households and 7 million small businesses were impacted by a breach that reportedly began in June and was not detected until late July. One fraud expert calls the breach "a national crisis."
European financial services firms and law enforcement agencies have been stepping up their efforts to trade actionable intelligence and better defend themselves against emerging malware and fraud campaigns.
The Justice Department announces that four alleged members of an international hacking ring have been charged with stealing intellectual property valued at $100 million, including a U.S. Army Apache helicopter simulator and Microsoft Xbox prototypes.
Banking institutions must mitigate all Shellshock vulnerabilities in their internal and customer-facing banking systems. Experts recommend beginning with automated and manual Bash-bug scanning, as well as educating customers about the risks.
The automated version of the IT risk management and governance framework should save project leaders 30 to 60 hours of work over a manual process of building a secure IT system, ISACA President Robert Stroud says.