“Fool me once, shame on you; fool me twice, shame on me.” That could be the motto of a Virginia bank that was hacked two times in less than a year, costing the bank $2.4 million.
The National Bank of Blacksburg suffered its first cyberattack in May of 2016 when an employee was tricked by a phishing email that installed malware on the computer. That allowed the hackers access to another computer that had access to a system that connected to First Data’s STAR Network, which handles debit card transactions. Using that second computer, the hackers were able to gain access to customer accounts and their bank cards, letting the hackers modify security settings, PINs, withdrawal limits, and other information.
That incident netted the thieves $569,000. In light of that, the National Bank of Blacksburg hired Foregenix to look into the cyberattack. National Bank also implemented security recommendations by FirstData. In light of losing half a billion dollars and the precautions taken, you’d think National Bank would be pretty secure.
And yet, merely eight months later, hackers attacked again. This time the hackers were able to gain access to Navigator, which is banking software that takes care of credits and debits to bank accounts. The hackers credited $2 million to accounts then withdrew the extra money from ATM machines. The hackers were even able to delete records of the withdrawals from the accounts.
Verizon was hired to investigate this incident and determined that the hackers were from Russia and that they were the same ones that perpetrated the first attack. They also were able to determine that the malware came in the form of a Word Document, which probably means an employee, despite the precautions National Bank may have taken, opened at attachment on an email.
The story doesn’t end there, however. National Bank has filed a lawsuit against Everest National Insurance Company, a company with whom they have cyberinsurance. Without getting too deep into legal jargon and reasoning, the two sides have a difference in opinion of what is covered, making a huge difference in the amount First National can recover from their two hack disasters.
If your company uses computers, and just about every company does these days, it is absolutely imperative that your employees are trained in cybersecurity awareness. We can provide cybersecurity awareness training, and it’s never too soon to get started. Contact us today to help make sure you don’t become the victim of a cyberattack.