HackingFinanceCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

J.P. Morgan

bd_7f9042b5f1648a92 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 26, 2024

Filed

Apr 18, 2024

To disclose

7 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

66%

J.P. Morgan disclosed a data breach involving a software issue that allowed three authorized system users to view plan participant information. The incident occurred between August 26, 2021, and February 23, 2024. Affected data included names, addresses, Social Security numbers, payment amounts, and bank routing/account numbers for individuals with direct deposit. J.P. Morgan applied a software update to fix the access issue and offered two years of free credit monitoring via Experian. No indication of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 914 days

discovery → filing · 7 weeks / 52 days

Aug 26, 2021

Begins

Feb 26, 2024

Discovered

Apr 18, 2024

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_2c75438adc27bcc82024-04-18Verified
California State AGbd_17c628b4b6b443e32024-04-27 · +9dCandidate
Oregon State AGbd_5db5795a826bccef2024-04-28 · +10dVerified
Montana State AGbd_d35e9bad8d06eb142024-05-06 · +18dVerified

Name: JPMorgan Chase Bank, National Association
norm: jpmorgan chase bank national

Name: J.P. Morgan
norm: jp morgan
Domain: jpmorgan.com

Discovered: Feb 26, 2024
Breach occurred: Aug 26, 2021 – Feb 23, 2024
Undetected for: 914 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Addressed the access issue
Applied a software update
Offered two years of free credit monitoring through Experian’s IdentityWorks
Changes made: Applied a software update
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Vermont State AGApr 18 · first

Delaware State AGApr 18 · first · this page

California State AG+9d

Oregon State AG+10d

Montana State AG+18d

Pattern: first filing Apr 18 (VT), last May 6 (MT) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2024/05/J.P.-Morgan-Privacy-Breach-Template.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 18, 2024
Raw hash: 0ed711b78f8c37187af506ffea11de59d4b3fb17bdbd6779f77a228e5e128462

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityJPMorgan Chase Bank, National Association

Victim entityJ.P. Morgan

Incidentdiscovered Feb 26, 2024

Stated responseAddressed the access issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov