The cyberattack on JPMorgan Chase that enabled the largest known American bank intrusion to date could have been prevented with a simple security fix, according to new data.  A report from the New York Times identifies the hackers' entry point. The attack, which ultimately compromised the contact information of 76 million households and 7 million small businesses, started last spring when one employee's login information was stolen.  Things could have stopped there, but JPMorgan's security team failed to update one of its servers to include two-factor authentication, according to anonymous sources from within the company referenced in the report. The bank officially revealed the scope of the breach in October.  Two-factor authentication is one of the most basic extra layers of security access. It means that in addition to a user's regular password, you need another one-time, uniquely generated code that may be sent to your smartphone, for example. That single server — without such protection — left the bank wide open for intrusion since it only required the stolen login credentials and not a secondary code.  JPMorgan is now undergoing a top-to-bottom internal review that is looking to weed out security holes in its network. The bank views the breach as a public embarrassment, according to Times.  JPMorgan Chase maintains that no account information or social security numbers were compromised in the breach, only contact information like phone numbers and email addresses. Hackers could exploit this information through phishing schemes, like fraud email messages or phone calls purporting to be from the bank.  The bank claims it will never ask for your personal information in an email or text message, so if you receive a suspicious message, it's best to ignore it and contact JPMorgan Chase. The bank also published a guide to help spot phishing schemes.  The attack method was simple compared to many other hacking techniques, which often employ malware. JPMorgan Chase spends $250 million on security each year, according to Times report, to deter the sort of sophisticated attack that Sony Pictures Entertainment continues to reel from.  When Bloomberg first reported on the JPMorgan cyberattack in August, the FBI was investigating whether it was an advanced retaliatory action from Russia. This belief was rooted in the fact that Russia was unhappy with U.S. sanctions that came in response to the country's actions in Ukraine.  Later, that option was officially ruled out, but the origins of the attack are still unknown.  Trey Ford, a global security strategist at security firm Rapid7, told Mashable that organizations like JPMorgan Chase should go even further than two-factor authentication to protect their customers. They need to vigilantly monitor account usage, or breaches like this one will continue, according to Ford.  "Compromised credentials have been a factor in the vast majority of breaches including Sony and Target," Ford wrote in an email. "Once an attacker has a privileged credential, they can usually access sensitive data and escape most incident detection solutions because they appear as a valid user to those detection solutions. This is how attackers are staying undetected in organizations for days, months and sometimes even years.”  JPMorgan Chase declined to comment to Mashable.  Have something to add to this story? Share it in the comments.
The entry point that allowed hackers to access millions of contact information from JPMorgan Chase's database has been identified.