Under U.S. law, companies are required to notify authorities of cyberattacks affecting at least 500 American residents. Following this rule, representatives of the financial giant HSBC submitted a statement to the California Attorney General’s office (PDF) reporting a recent attack on its systems.
The document states that the incident occurred between October 4 and October 14, 2018. The exact number of affected users has not been disclosed, but it reportedly amounted to “less than 1%.” Given that roughly 1.2 million people use HSBC services in the United States, this would mean up to 12,000 American users, not counting customers in other countries, if the attack affected them as well.
At this time, the accounts of all victims have already been blocked, and the bank has launched a process allowing them to change their passwords. The document also states that HSBC has now added an additional “layer of protection” for user accounts, but the representatives of the financial institution do not go into details.
Judging by the description of the attack in the document, HSBC experienced what is known as “credential stuffing.” This term refers to situations in which usernames and passwords are stolen from certain sites and then used against others. In other words, attackers have a predefined database of login credentials (acquired on the darknet, collected independently, etc.) and try to use this data to log in to all sites and services under the identities of their victims.
Following the attack, unknown attackers were able to access HSBC customer information. This included full names, postal addresses, phone numbers, email addresses, dates of birth, account numbers, account types, balance information, transaction history, statement history, and more.
It is worth noting that HSBC representatives are now offering affected users one year of free credit monitoring and identity theft protection.
