Scottrade Security Breach Could Spawn Stock Scams Targeting 4.6 Million Customers

If you hear from Scottrade in the next few days, it may not be about a promising investment opportunity. The discount brokerage is contacting those who may have been affected by a security breach involving an estimated 4.6 million clients.

A statement from Scottrade explained that the data breach likely took place between the end of 2013 and the first months of last year. Scottrade said it believes cybercriminals were primarily trying to acquire customer contact information. However, other personal data such as Social Security numbers was likely compromised, as well. Federal authorities asked the company to hold off on informing customers until now, though the breach came to light in August.

The Wall Street Journal pointed out that news of the Scottrade security breach comes just in time for the Department of Homeland Security’s National Cyber Security Awareness Month (NCSAM). It also follows similar security incidents in the financial services sector involving JPMorgan Chase and others. A Scottrade spokeswoman told the newspaper the full extent of potentially affected customers remains uncertain.

Dark Reading interviewed a security expert who noted that Scottrade has struggled with IT errors that led to fines for failing to provide proper logs of trading activity. Although the FBI and similar law enforcement agencies need time to properly investigate these attacks, others said Scottrade should have been able to notify customers about the security breach before now.

Scottrade hasn’t seen any suspicious activity involving the information stolen in the security breach so far, but these might be early days, Wired reported. If contact details were the primary motive, it’s possible they could be used to send spam emails as part of more elaborate phishing schemes that take advantage of investors. Scottrade has said it will provide customers a full year of free identity theft protection, but that may not do much to reassure them given the magnitude of the hack.

Security researcher Brian Krebs suggested that if a slew of email stock scams is the worst that happens to Scottrade customers, they should be grateful. The bigger issue is how this security breach took place and how other firms could work to prevent similar problems in the future.

Shane Schick

Writer & Editor

NIST’s role in the global tech race against AI

4 min read - Last year, the United States Secretary of Commerce announced that the National Institute of Standards and Technology (NIST) has been put in charge of launching a new public working group on artificial intelligence (AI) that will build on the success of the NIST AI Risk Management Framework to address this rapidly advancing technology.However, recent budget cuts at NIST, along with a lack of strategy implementation, have called into question the agency’s ability to lead this critical effort. Ultimately, the success…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from

NIST’s role in the global tech race against AI

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

Topic updates