Regions Data Breach Confirmed. On 11 Oct., Regions Financial Corp. reported the occasional breakdowns relating to their online banking and corporate websites.
Based on the threats posting on Pastebin by the hacktivist group Izz ad-Din al-Qassam on Oct. 8, they planned the area site shuts. In the last four weeks, Regions have become the eighth bank of the US to hit online.
“We are experiencing an Internet service disruption that is intermittently impacting our customers’ ability to access our website or use our online banking service,” says Evelyn Mitchell, spokeswoman for the zone, tells BankInfoSecurity. “We are working quickly to resolve this issue and regret any inconvenience customers may be experiencing.”
They confirmed that the Regions suffered intermittent outages during the morning and early afternoon of Oct. 11, according to Is It Down Right Now a break-out blog. Down For All Not Just I, another monitoring platform also verified the failings. Early afternoon, however, the online-outage-tracking site Sitedown did not have any failures in the areas.
Attacks sequence
Related DDoS attacks in late September have affected Bank of America, Chase Bank, Wells Fargo, PNC Bank, and the United States. Bank. Banking. Earlier this week, Capital One and SunTrust were struck.
On 8 October the party that borrowed from attacks, Izz Ad Din al-Qassam warned of hits on 9 October against Capital One on 10 Oct. the SunTrust and on 11 Oct. the Area Bank. The promised days culminated in all the obvious assaults.
Industry analysts are now waiting for the next bank.
Izz ad-Din Al-Qassam says he plans to begin making plans for more attacks next week as part of a campaign coined by Operation Ababil. The group states in its 8th October message, “The plan for the October 2nd week attack is announced. “Weekends: planning for the next week’ attacks.”
Uncertain inspiration
The motive behind the attacks remains confusing. Izz ad-Din al-Qassam says it fights a cyberwar against leading bankers, as an outrage against a YouTube movie trailer that the party feels is anti-Islamic. However, analysts wonder if this indignation is just a cover for something more evil.
Back to now the banks targeted by DDoS attacks have reported no fraud. However, Gartner analyst Avivah Litan says accounting and wire fraud in the past or through the call center may be the key concerns of organizations.
“There are anecdotes about money loss during these attacks, e.g. through calls to the call center to get wire transfers done while the website was down,” she explains.
Tighten fraud controls
In this way, organizations must tighten the controls on fraud prevention “especially at the call center and around access from employee accounts, the new attack vectors,” Litan says.
However, Alphonse Pascual, a Javelin Strategy & Analysis financial crime analyst, says it is too early to know why banks are attacked. “Hitting banks gets a lot of attention; so I’m not sure if that’s the motivation or if it’s something else,” he says.
Pascual says, “So we don’t even know who’s behind those threats. “We have all sorts of means to end attacks and many things will happen in the context of something we don’t know about.” “If it is a nation-state attack, it may be very dangerous.
