After Breach, JPMorgan Still Seeks to Determine Extent of Attack

The headache caused by the attack on JPMorgan Chase’s computer network this summer may not go away anytime soon.

Over two months, hackers gained entry to dozens of the bank’s servers, said three people with knowledge of the bank’s investigation into the episode who spoke on the condition of anonymity. This, they said, potentially gave the hackers a window into how the bank’s individual computers work.

They said it might be difficult for the bank to find every last vulnerability and be sure that its systems were thoroughly secured against future attack.

The hackers were able to review information about a million customer accounts and gain access to a list of the software applications installed on the bank’s computers. One person briefed said more than 90 of the bank’s servers were affected, effectively giving the hackers high-level administrative privileges in the systems.

Hackers can potentially crosscheck JPMorgan programs and applications with known security weaknesses, looking for one that has not yet been patched so they can regain access.

A fourth person with knowledge of the matter, also speaking on condition of anonymity, said hackers had not gained access to account holders’ financial information or Social Security numbers, and may have reviewed only names, addresses and phone numbers.

The hack began in June and was not detected until late July. JPMorgan briefed financial regulators on the extent of the damage last week. Investigators say they believe that at least four other banks or financial institutions were also affected.

“We uncovered an attack by an outside adversary recently where the firm’s technology environment was compromised,” said Kristin Lemkau, a JPMorgan spokeswoman. “We are confident we have closed any known access points and prevented any future access in the same way.”

Ms. Lemkau added that the bank had “not seen any unusual fraud activity” since the intrusion was discovered and said that there was “no evidence that they have taken any proprietary software” or had a “blueprint” of the bank’s computer network.

The fact that much is unknown about the extent of the breach has unnerved people within the bank, the people with knowledge of the investigation said, and has put JP Morgan, the largest bank in the United States, in a precarious position.

CreditMike Segar/Reuters

Over the last month, JPMorgan has called in the Federal Bureau of Investigation and outside security experts to investigate and remediate its systems.

Kelly Langmesser, an F.B.I. spokeswoman, declined to comment.

Given the level of sophistication of the attack, investigators say they believe it was planned for months and may have involved some coordination or assistance from a foreign government. The working theory is that the hackers most likely live in Russia, the people briefed said.

They said the fact that no money was taken did not necessarily mean it was a case of state-sponsored espionage, only that the bank was able to stop the hackers before they could siphon customer accounts.

The website for the JPMorgan Corporate Challenge, a foot race that pits employees of various companies against one another for charity, was also recently attacked. The site is maintained by an outside vendor, and it was unclear whether its breach was related to the bank’s.

After the Corporate Challenge attack, JPMorgan sent a letter to some website users saying that on Aug. 7, it had discovered that hackers had compromised login credentials and passwords. But the bank does not believe that the website attack was the entry point for the broader intrusion into JPMorgan’s network.

The Corporate Challenge website has been scrubbed of much of its information for several weeks. A message on the site says: “We’re sorry that other content on this website isn’t available now. We’re working on it.”

The attack on JPMorgan’s systems came at a particularly sensitive time for the bank’s security team. Last spring, Anthony Belfiore, the bank’s chief information security officer, left JPMorgan for First Data, a payment processor based in Atlanta, following a number of other security specialists who had left JPMorgan for the company over the last year.

It was not until June that JPMorgan brought in a new chief information security officer, Greg Rattray, a former commander in the United States Air Force who specialized in cyberattack defense. But by then, hackers had already found a way into JPMorgan’s systems.

Ultimately, those with knowledge of the investigation said, the breach was a close call, given that it was detected before hackers could pull out reams of data.

Mitchell Silber, the former director of intelligence at the New York Police Department who is now the executive managing director at K2 Intelligence, a private investigation firm, said the troubling thing for the bank was that it was unclear exactly how much damage was done.

Mr. Silber, whose firm is not involved in the inquiry, added: “The question is, Have some other trap doors been left over that can be accessed?”

A version of this article appears in print on , Section B, Page 1 of the New York edition with the headline: Bank Still Seeks to Assess Extent of Breach. Order Reprints | Today’s Paper | Subscribe