Major Wall Street banks have been caught up in a cyber-attack targeting a third-party tech vendor, potentially exposing sensitive customer and mortgage data from the likes of JPMorgan Chase, Citi, and Morgan Stanley.

SitusAMC, a New York-based tech provider used by hundreds of banks to process and collect real estate loans, confirmed on Saturday (22 Nov) that hackers had breached its systems, exposing both corporate data and information tied to clients’ customers.

SitusAMC said the breach, first noticed on November 12th, saw some of its accounting records and legal agreements with clients exposed, though hackers were also reported to have accessed data linked to residential mortgages.

In a letter to customers, the vendor said that the “scope, nature and extent of such impact remains under investigation”, adding that it had moved quickly to secure its systems and, with the help of security experts and federal law enforcement, was working to identify any further data loss.

“Our systems and services are fully operational, and we are providing full service to our clients. The incident is now contained and did not involve encrypting malware,” wrote the firm.

“The Company and its third-party advisors are working around the clock on our investigation, and we will provide another update as we have more information to share and as appropriate.”

While SitusAMC did not name the clients hit by the hack, sources briefed on the incident told the New York Times that banking giants like JPMorgan Chase were among those affected, with the vendor reportedly holding relationships with the majority of leading banks, private equity firms, asset managers, and insurance companies working in the real estate sector.

Due to SitusAMC’s central role in managing a swathe of the US mortgage market, currently standing at $13.5 trillion (£10.3trn), roughly equivalent to 44% of America’s GDP, the hack has raised concerns around the trove of information the company has collected. 

That includes not only customers’ personal data and other identifiers contained in loan applications, but also sensitive details about the inner workings of the world’s largest investment banks, the backbone of the American economy, though the banks themselves were quick to point out that they were not directly hit in the attack. 

The scale of the breach prompted FBI Director Kash Patel to issue a market calming statement, telling the NYT: “While we are working closely with affected organisations and our partners to understand the extent of potential impact, we have identified no operational impact to banking services.” 

Recommended reading

• 58% of Large FS Firms Hit With Supply Chain Attack in 2024
• Less Than A Quarter of Supply Chain Leaders Have An AI Strategy
• New Report Reveals Extent of Cyber-risk in Global Supply Chain

Most prominently, Marks & Spencer lost a reported £136 million in profit following the breach of a third-party contractor, while just last week, Salesforce suffered a breach related to the Gainsight platform, which Google estimated to have impacted the data from more than 200 companies.     

Figures show that more than 70% of organisations reported at least one material third-party cyber incident in the past year, spurring major firms to rethink their security strategies, including JPMorgan’s CISO, Patrick Opet, who said in April that third-party vendors should be required to boost their security practices to avoid major disruptions across financial services.

Don’t Miss Scotland’s Largest Tech Event of the Year – DIGIT Expo: 27th November

50 Speakers – 40 Exhibitors – 2000 Delegates

Don’t miss DIGIT Expo, Scotland’s largest annual tech gathering, taking place at the EICC in Edinburgh on 27th November. We have a stacked conference agenda with 5 Stages of leading edge content, including presenters from Microsoft, Amazon, Spotify, Morgan Stanley, Alibaba, and NVIDIA…

Register now at: https://digit-expo.com/