#cyberheist

🎬 Cyber Heist (斷網) 🎬 แอ็กชันไซเบอร์ดราม่าจากฮ่องกง ที่ผสม CGI โลกไซเบอร์สุดแฟนตาซี Aaron Kwok นำทีม สู้ทั้งในโลกจริงและโลกดิจิทัล

In a stark reminder of the evolving landscape of cyber threats, the Himachal Pradesh State Co-operative Bank has become the target of a significant cyber fraud, with fraudsters siphoning off a staggering ₹11.55 crore (US$1.35 million). The audacious attack involved compromising a customer’s mobile phone to gain unauthorised access to the bank’s server, highlighting the increasing sophistication…

Exclusive: NY Fed first rejected cyber-heist transfers, then moved $81 million

Exclusive: NY Fed first rejected cyber-heist transfers, then moved million DHAKA/NEW YORK (Reuters) – Hours before the Federal Reserve Bank of New York approved four fraudulent requests to send $ 81 million from a Bangladesh Bank account to cyber thieves, the Fed branch blocked those same requests because they lacked information required to transfer money, according to two people with direct…

Exclusive: NY Fed first rejected cyber-heist transfers, then moved $81 million

Exclusive: NY Fed first rejected cyber-heist transfers, then moved million DHAKA/NEW YORK (Reuters) – Hours before the Federal Reserve Bank of New York approved four fraudulent requests to send $ 81 million from a Bangladesh Bank account to cyber thieves, the Fed branch blocked those same requests because they lacked information required to transfer money, according to two people with direct…

New Post has been published on http://www.newsfrombanks.com/hospital-sues-bank-of-america-over-million-dollar-cyberheist.html

Hospital Sues Bank of America Over Million-Dollar Cyberheist

A public hospital in Washington state is suing Bank of America to recoup some of the losses from a $ 1.03 million cyberheist that the healthcare organization suffered in 2013.

In April 2013, organized cyber thieves broke into the payroll accounts of Chelan County Hospital No. 1 , one of several hospitals managed by the Cascade Medical Center in Leavenworth, Wash. The crooks added to the hospital’s payroll account almost 100 “money mules,” unwitting accomplices who’d been hired to receive and forward money to the perpetrators.

On Thursday, April 19, and then again on April 20, the thieves put through a total of three unauthorized payroll payments (known as automated clearing house or ACH payments), siphoning approximately $ 1 million from the hospital.

Bank of America was ultimately able to claw back roughly $ 400,000 of the fraudulent payroll payments. But in a complaint (PDF) filed against the bank, the hospital alleges that an employee on the Chelan County  Treasurer’s staff noticed something amiss the following Monday — April 22, 2013 — and alerted the bank to the suspicious activity.

“Craig Scott, a Bank of America employee, contacted the Chelan County Treasurer’s office later that morning and asked if a pending transfer request of $ 603,575.00 was authorized,” the complaint reads. “No funds had been transferred at the time of the phone call.  Theresa Pinneo, an employee in the Chelan County Treasurer’s Office, responded immediately that the $ 603,575.00 transfer request was not authorized. Nonetheless, Bank of America processed the $ 603,575.00 transfer request and transferred the funds as directed by the hackers.”

Chelan County alleges breach of contract, noting that the agreement between the county and the bank incorporates rules of the National Automated Clearinghouse Association (NACHA), and that those rules require financial institutions to implement a risk management program for all ACH activities; to assess the nature of Chelan County’s ACH activity; to implement an exposure limit for Chelan County; to monitor Chelan County’s ACH activity across multiple settlement dates; and to enforce that exposure limit. The lawsuit alleges that Bank of America failed on all of those counts, and that it ran afoul of a Washington state law governing authorized and verified payment orders.

In a response (PDF) filed with the U.S. District Court for the Eastern District of Washington at Spokane, Bank of America denied nearly all of the allegations in the lawsuit, including that it ignored the hospital’s warning not to process the $ 603,575 payment batch.

The bank noted that its contractual obligations with the county are governed by the Uniform Commercial Code (UCC), which has been adopted by most states (including Washington). The UCC holds that a payment order received by the [bank] is “effective as the order of the customer,whether or not authorized, if the security procedure is a commercially reasonable method of providing security against unauthorized payment orders, and the bank proves that it accepted the payment order in good faith and in compliance with the security procedure and any written agreement or instruction of the customer restricting acceptance of payment orders issued in the name of the customer.”

This cyberheist mirrors attacks against dozens of other businesses over the past five years that have lost tens of millions of dollars at the hands of crooks armed with powerful banking Trojans such as ZeuS. It’s not clear what strain of malware was used in this attack, but the money was funneled through a cashout gang that this blog has tied to cyberheists orchestrated by organized crooks who distributed ZeuS via email spam campaigns.

Business and consumers operate under vastly different rules when it comes to banking online. Consumers are protected by Regulation E, which dramatically limits the liability for those who lose money from unauthorized account activity online (provided the victim notifies their financial institution of the fraudulent activity within 60 days of receiving a disputed account statement).

Businesses, however, do not enjoy such protections. The victim organization’s bank may decide to reimburse the victim for some of the losses, but beyond that the only recourse for the victim is to sue the their bank. Under state interpretations of the UCC, the most that a business hit with a cyberheist can hope to recover is the amount that was stolen. That means that it’s generally not in the business’s best interests to sue their bank unless the amount of theft was quite high, because the litigation fees required to win a court battle can quickly equal or surpass the amount stolen.

So, if you run a business and you’re expecting your bank to protect your assets should you or one of your employees fall victim to a malware phishing scheme, you could be in for a rude awakening. Keep a close eye on your books, require that more than one employee sign off on all large transfers, and consider adopting some of these: Online Banking Best Practices for Businesses.

Tags: ACH, Bank of America, Cascade Medical Center, Chelan County Hospital No. 1, NACHA, National Automated Clearinghouse Association, Uniform Commercial Code

http://www.solutionssquad.com/blog/tenn-firm-sues-bank-over-327k-cyberheist/

Tenn. Firm Sues Bank Over $327K Cyberheist

It was one of the biggest heists in history, fleecing half-a-billion dollars from people around the globe, and almost no one—except a small group of thieves, their confederates and the white-hat computer sleuths chasing them through cyberspace—knew it was taking place.

In January, federal investigators announced that Aleksandr Andreevich Panin, a Russian national who was the mastermind behind the crimes, had pleaded guilty to conspiracy to commit fraud. Panin's capture was far more than just another tale of a crook who found illicit riches online. His case reveals many alarming details of a lawless underground flourishing in the darkest corners of the Internet, where hackers peddle off-the-shelf software that, for as little as a few thousand dollars, allows even the most unsophisticated computer novice to start emptying the bank accounts of people they've never met, or even seen.

No longer does someone bent on Internet crime have to dedicate weeks to writing code and testing programs, or even have the basic knowledge required to do so. Anyone can become an expert thief in a matter of minutes by using programs sold through hacker websites. The illegal programs—known as malware toolkits or crimeware—have their own brand names, like ZeuS, SpyEye and the Butterfly Bot.

The evolution of these programs presents a complex challenge for law enforcement as the range of wrongdoers has dramatically expanded, increasing both the number of perpetrators and the ease with which they can commit fraud. Malware toolkits "have created an all-new type of hacker,'' says Timothy Ryan, a former cybercrime specialist at the Federal Bureau of Investigation who is now a managing director of cyber investigations at Kroll, a private security company. "Whenever you have a proliferation of these weapons, it just means that the bar to entering cybercrime is a lot lower."