A cyberattack this summer on JPMorgan Chase compromised more than 76 million household accounts and 7 million small-business accounts, making it among the largest corporate hacks ever discovered.
The latest revelations, which were disclosed in a regulatory filing Thursday, vastly dwarf earlier estimates that hackers had gained access to roughly 1 million customer accounts.
The new details about the extent of the hack, which began in June but wasn't discovered until July, sent JPMorgan scrambling to contain the fallout.
Hackers were able to burrow deep into JPMorgan's computer systems, accessing the accounts of more than 90 servers — a breach that underscores just how vulnerable the global financial system is to cybercrime. Until now, most of the largest hack attacks on corporations have been confined to retailers like Target and Home Depot.
And unlike those retailers, JPMorgan has far more sensitive financial information about customers. Investigators in law enforcement remain puzzled by the attack on the bank because there is no evidence that the attackers looted any customer money from accounts.
In its filing, JPMorgan said there was no evidence that account information, including passwords or Social Security numbers, were taken.
The lack of any apparent profit motive has generated speculation among law enforcement officials and security experts that the hackers were sponsored by foreign governments either in Russia or in southern Europe.
By the time JPMorgan first suspected the breach in late July, hackers had already "rooted" more than 90 computer servers — hacker-speak for gaining the highest level of privilege to those machines — according to several people briefed on the results of the bank's forensics investigation who were not allowed to discuss it publicly.
It is still not clear how hackers managed to gain deep access to the bank's computer network.
More disturbing still, say people familiar with the matter who asked not to be identified by the New York Times, hackers made off with a list of the applications and programs that run on every standard JPMorgan computer — a hacker's road map of sorts — which hackers could cross-check with known vulnerabilities in each program and Web application, in search of an entry point back into the bank's systems.
The people familiar with the matter said it would take months for the bank to swap out its programs and applications and renegotiate licensing deals with its technology suppliers, leaving hackers plenty of time to mine the bank's systems for unpatched, or undiscovered, vulnerabilities that would allow them re-entry into JPMorgan's systems.
The original hack sent ripples through the financial system and prompted an FBI investigation, even as Wall Street, which has been a frequent target for hackers in recent years, worked to guard against the threats.
The bank was also forced to update its regulators, including the Federal Reserve, on the extent of the breach. The bank said at the time that there was no indication any customer money was taken and that it thought it had secured all its systems.