Major Banks Hit With Biggest Cyberattacks In History

NEW YORK (CNNMoney) — There’s a good chance your bank’s website was attacked over the past week.

Since Sept. 19, the websites of Bank of America (BAC), JPMorgan Chase (JPM), Wells Fargo (WFC), U.S. Bank (USB) and PNC Bank (PNC) have all suffered day-long slowdowns and been sporadically unreachable for many customers. The attackers, who took aim at Bank of America first, went after their targets in sequence. Thursday’s victim, PNC’s website, was inaccessible at the time this article was published.

Security experts say the outages stem from one of the biggest cyberattacks they’ve ever seen. These “denial of service” attacks — huge amounts of traffic directed at a website to make it crash — were the largest ever recorded by a wide margin, according to two researchers.

Banks get hit by cyberattackers all the time and typically have some of the best defenses against them. This time, they were outgunned.

“The volume of traffic sent to these sites is frankly unprecedented,” said Dmitri Alperovitch, co-founder of CrowdStrike, a security firm that has been investigating the attacks. “It’s 10 to 20 times the volume that we normally see, and twice the previous record for a denial of service attack.”

To carry out the cyberattacks, the attackers got hold of thousands of high-powered application servers and pointed them all at the targeted banks. That overwhelmed Bank of America and Chase’s Web servers on Sept. 19, Wells Fargo and U.S. Bank on Wednesday and PNC on Thursday. Fred Solomon, a spokesman for PNC, confirmed that a high volume of traffic on Thursday was affecting users’ ability to access the website, but he declined to go into more detail.

Denial of service attacks are an effective but unsophisticated tool that doesn’t involve any actual hacking. No data was stolen from the banks, and their transactional systems — like their ATM networks — remained unaffected. The aim of the attacks was simply to temporarily knock down the banks’ public-facing websites.

To get hold of all the servers necessary to launch such huge attacks, the organizers needed to plan for months, Alperovitch said. The servers had to be compromised and linked together into a network called a “botnet.”