In recent years, financial data breaches have exposed a variety of personal information concerning finances, personally identifiable information (PII), health care, legal issues, and more. The theft of this information was accomplished by outsiders hacking computer systems, insiders with and without authorized access to the files, loss of laptops and other physical media, and accidental publication. According to one source, 78% of all records compromised during the first six months of 2014 were exposed as the result of outsiders. Recent large financial data breaches affecting the payment system include Target: 2013, 40 million payment cards, 70 million records of customer names, addresses, telephone numbers, and email addresses; Adobe: 2013, 152 million customer names, encrypted passwords, encrypted payment card information; Home Depot: 2014, 56 million customer email addresses and payment cards; Heartland: 2009, 130 million payment card records; and TJX: 2007, 94 million payment card records (credit card numbers and transactions). This report concentrates on the loss of financial data, but there have also been nonfinancial data breaches, including Sony Corporation (PlayStation Network): 2011, 77 million names, addresses, email addresses, and other personal information; Sony Picture Entertainment: 2014, a large, but unknown number of files reportedly containing personal information, internal Sony discussions, and unreleased movies, and other; JPMorgan Chase & Co. (JPMorgan): 2014, 76 million household customer names, telephone numbers, and other information and 7 million small business records; and Tricare Management Activity: 2011, 4.9 medical records lost. Breaches have also occurred in other nations, including Korea (2014), the theft of 220 million records containing personal information and passwords, and China (2012), 150 million records stolen from Shanghai Roadway & Marketing. According to Target, in November and December of 2013, information on 40 million payment cards (i.e., credit, debit, and ATM cards) and personally identifiable information (PII) on 70 million customers was compromised. The Secret Service has announced that it is investigating the data breach, but has released no details. In congressional hearings, Target's executive vice president testified that an intruder used a vendor's access to Target's system to place malware on point-of-sale (POS) registers. The malware captured credit and debit card information before it was encrypted, which would render it more difficult (or impossible) to read. In addition, the intruder captured some strongly encrypted personal identification numbers (PIN). It is very unlikely that all 40 million payment cards compromised at Target will be used in fraudulent transactions. Some cards will be canceled before they are used, some attempts to use valid cards will be denied by the issuing financial institutions, and there will be no attempt to make fraudulent use of some. According to media reports, some financial institutions responded to the Target breach by issuing new cards to all of their cardholders, and others decided to depend on antifraud monitoring. Initially, Wells Fargo, Citibank, and JPMorgan Chase replaced debit cards, but not credit cards, and Bank of America and U.S. Bank are depending on fraud detection. Companies that suffer data breaches rarely publish detailed timelines. Target, possibly because senior management testified before Congress on the situation, is an exception to this rule. According to testimony of John J. Mulligan, executive vice president and chief financial officer of Target, the key dates in the Target breach are as follows: November 12, 2013—intruders breached Target's computer system. The intrusion was detected by Target's security systems, but the company's security professionals took no action until notified by law enforcement of the breach. December 12, 2013—the Department of Justice (DOJ) notified Target that there was suspicious activity involving payment cards that had been used at Target. December 13, 2013—Target met with DOJ and the U.S. Secret Service. December 14, 2013—Target hired outside experts to conduct a thorough forensic investigation. December 15, 2013—Target confirmed that malware had been installed and that most of the malware had been removed. December 16 and 17, 2013—Target notified payment processors and card networks that a breach had occurred. December 18, 2013—Target removed the remaining malware. December 19, 2013—Target made a public announcement of the breach. December 27, 2013—Target announced the theft of the encrypted PIN data. January 9, 2014—Target discovered the theft of PII. January 10, 2014—Target announced the PII theft. Target estimates that the 40 million payment card and 70 million PII data breaches have at least 12 million people in common, making 98 million the maximum number of customers affected. Fazio Mechanical Services, which provided heating, ventilation, and air conditioning (HVAC) services for Target, has said it was used to breach Target's payment system. A Fazio computer authorized to submit contract billing and project management information to Target reportedly was compromised by intruders. According to some media reports, Fazio was the victim of a phishing email containing malware that was used to install other malware in Target's network, including its POS system that records payment card transactions. Payment card companies require any business accepting payment cards to follow PCI rules regarding security of their payment card processing. Target has testified that its systems were reviewed in September 2013 and certified as compliant. The magnetic stripes on the back of U.S. credit cards are not encrypted. According to media reports, malware known as a "memory scraper" captured information from customers' payment cards by reading the POS system's memory before it was encrypted. After the initial announcement of the Target data breach, other possibly related data breaches were reported, including at Neiman Marcus (a luxury retailer), Michaels (an arts and crafts retailer), Home Depot, OneStopParking, and White Lodging (a hotel management company), which had been notified by law enforcement that they had suffered related data breaches. In summary, it appears that 1. someone obtained a vendor's credentials to access the Target vendor billing and invoicing system, 2. access to the vendor billing and invoicing system was escalated to access into Target's POS system, 3. this was used to introduce malware into the system, 4. warnings about this malware were initially ignored, 5. Target software was used to spread the malware to virtually all of Target's POS devices, 6. the credit card data were stored in innocuously named files and sent to servers outside Target's system and then on to other servers, and 7. warnings about transmitting the data were ignored. On October 2, 2014, JPMorgan Chase reported to the Securities and Exchange Commission (SEC) that a cyberattack had compromised the PII of approximately 76 million households and 7 million small businesses. The compromised PII included names, addresses, phone numbers, email addresses, and "internal JPMorgan Chase information relating to such users." According to the company's filing, there was no evidence that account information, user IDs, passwords, social security numbers, or birth dates for the affected customers were compromised. The company said that it had not seen any unusual customer fraud related to the incident. It reassured customers that they would not be liable for any unauthorized activity on their accounts, if it were reported promptly. Prior to the October 2 filing, the firm's disclosure of the incident was general. In its regular report for the second quarter of 2014, JPMorgan Chase stated, "The Firm is also regularly targeted by unauthorized parties using malicious code and viruses, and has also experienced other attempts to breach the security of the Firm's systems and data which, in certain instances, have resulted in unauthorized access to customer account data." According to media reports, hackers gained access sometime in mid-June 2014 to JPMorgan servers storing contact information for current and former customers who had accessed the company's chase.com or jpmorgan.com websites or mobile applications in recent years. According to media reports, the company learned of the data breach in mid-August and took steps to stop any unauthorized access at its servers. On August 27, 2014, Bloomberg and The Wall Street Journal both reported that the Federal Bureau of Investigations (FBI) was investigating a possible computer hacking attack on JPMorgan and possibly other financial institutions. The FBI later released a statement that it was "working with the United States Secret Service to determine the scope of recently reported cyberattacks against several American financial institutions." On August 28, 2014, JPMorgan reiterated to customers that it was not seeing an "unusual fraud activity," in other words, it appears that the hackers have not used the information they obtained for fraudulent purposes. JPMorgan continued by stating that the hackers went to considerable effort, but were unable to monetize the information that they stole. Of course, it could be that they are simply waiting until a later date or that their monetization of the information has been undetected. According to the New York Times , the same hackers—believed to be located overseas—who breached JPMorgan's network also infiltrated the website for the JPMorgan Corporate Challenge, run by an outside vendor for the bank on a server maintained by an outside Internet firm. JPMorgan has not announced how hackers penetrated its network, but the bank said they did not gain access through the Corporate Challenge website. This section looks at the costs reported by companies in three data breaches: Target, Home Depot, and JPMorgan. These costs typically include only direct costs, such as hiring consultants and staff to end the breach and to prevent future breaches, and contractually agreed compensation to business partners (such as payment card companies) for their losses. Not all companies include the savings from the tax deductibility of these costs or insurance claims. Many costs, especially those resulting from legal action against the companies, will not be known for many years after the data breach.