Incident: Title: Citigroup Hack: Millions Stolen from Customer Credit Card Accounts

Published Date: 2011-06-27

Postmortem Analysis
Timeline 1. The software failure incident at Citigroup, where a hack attack stole millions of dollars from customers' credit card accounts, happened in May 2011 [6198].
System 1. Citigroup's security system [6198]
Responsible Organization 1. Hackers accessed Citigroup's systems, causing the software failure incident [6198].
Impacted Organization 1. Citigroup - [6198]
Software Causes 1. The software cause of the failure incident at Citigroup was a hack attack that resulted in the theft of millions of dollars from customers' credit card accounts [6198].
Non-software Causes 1. The hack attack on Citigroup resulted in the theft of millions of dollars from customers' credit card accounts, indicating a breach in the bank's security measures [6198]. 2. The delay in notifying customers about the hack, with Citigroup waiting more than three weeks after the discovery of the breach to start sending out notification letters, could be considered a non-software cause of the failure incident [6198].
Impacts 1. Approximately $2.7 million was stolen from about 3,400 accounts, out of a total of 360,083 hacked accounts, in the Citigroup hack incident [6198]. 2. Citigroup issued more than 200,000 new credit cards to hacked customers as a response to the security breach [6198]. 3. Customers were not held liable for any fraud on their accounts and were 100% protected from financial losses resulting from the hack [6198].
Preventions 1. Implementing stronger cybersecurity measures such as multi-factor authentication and encryption to protect customer accounts [6198]. 2. Conducting regular security audits and penetration testing to identify and address vulnerabilities in the system [6198]. 3. Enhancing monitoring systems to detect unusual activities or unauthorized access in real-time [6198]. 4. Improving incident response protocols to ensure immediate action is taken upon the discovery of a breach [6198].
Fixes 1. Implementing stronger cybersecurity measures to prevent future hack attacks [6198] 2. Enhancing monitoring systems to detect unauthorized access to accounts promptly [6198] 3. Improving notification processes to inform affected customers promptly after a security breach [6198]
References 1. Citigroup (C, Fortune 500) [6198] 2. Electronic Arts (EA) [6198] 3. Sony (SNE) [6198] 4. Lockheed Martin (LMT, Fortune 500) [6198] 5. RSA Security, a division of EMC Corp. (EMC, Fortune 500) [6198] 6. Bank of America (BAC, Fortune 500) [6198]

Software Taxonomy of Faults

Category Option Rationale
Recurring multiple_organization (a) The software failure incident related to a hack attack on Citigroup's credit card accounts is not explicitly mentioned to have happened again within the same organization in the provided article [6198]. (b) The article mentions other high-profile security breaches that have occurred at different organizations: 1. Electronic Arts (EA) reported hackers breaching a server linked to a message board, stealing customer information. 2. Sony experienced major hacks in April and May, affecting its gaming systems and potentially compromising credit card numbers. 3. Hackers used SecurIDs to launch cyber attacks against Lockheed Martin, prompting RSA Security to offer replacements or monitoring for all SecurIDs. 4. Bank of America employees and some clients also use the tokens and are set to have them replaced [6198].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to the hack attack on Citigroup's system, which resulted in the theft of millions of dollars from customers' credit card accounts. The hackers were able to access a large number of accounts, indicating a vulnerability in the system's design that allowed unauthorized access. Citigroup took immediate action to rectify the situation and protect customers potentially at risk, suggesting that the breach was a result of contributing factors introduced during system development or updates [6198]. (b) The software failure incident related to the operation phase can be seen in the delayed response of Citigroup to the hack attack. Citigroup waited more than three weeks after discovering the breach to start sending out notification letters to affected customers. This delay in response could be considered a failure in the operation or management of the system, as prompt action could have potentially mitigated the impact of the attack [6198].
Boundary (Internal/External) within_system (a) within_system: The software failure incident reported in Article 6198 was a result of a hack attack on Citigroup's system. The hackers accessed a large number of accounts, with millions of dollars stolen from thousands of accounts within the system [6198]. Citigroup took immediate action to rectify the situation and protect customers potentially at risk, indicating that the failure originated from within the system due to security vulnerabilities that allowed the hack to occur.
Nature (Human/Non-human) non-human_actions (a) The software failure incident at Citigroup was due to non-human actions, specifically a hack attack. Hackers accessed a large number of accounts, with millions of dollars stolen from customers' credit card accounts [6198]. This incident was not caused by human error but rather by external malicious actors gaining unauthorized access to the system.
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles is not attributed to hardware issues. Instead, it is primarily related to a hack attack that resulted in the theft of millions of dollars from customers' credit card accounts at Citigroup [6198]. The incident involved unauthorized access to accounts and the subsequent theft of funds, indicating a software-related security breach rather than a hardware failure.
Objective (Malicious/Non-malicious) malicious (a) The objective of the software failure incident was malicious, as it was a hack attack on Citigroup's systems that resulted in the theft of millions of dollars from customers' credit card accounts. The hackers accessed a large number of accounts and stole money from about 3,400 accounts [6198]. Other high-profile security breaches mentioned in the article, such as those affecting Sony and Lockheed Martin, also indicate malicious intent behind the software failures.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident at Citigroup was primarily due to poor decisions made in terms of cybersecurity measures. The hack attack resulted in the theft of millions of dollars from customers' credit card accounts, with hackers accessing a large number of accounts and managing to steal from a significant portion of them [6198]. Additionally, the delay in notifying customers about the breach and the subsequent actions taken by the company indicate a lack of proactive decision-making in handling the security problem.
Capability (Incompetence/Accidental) development_incompetence, unknown (a) The software failure incident related to development incompetence is evident in the Citigroup hack attack reported in Article 6198. The incident involved hackers accessing a large number of accounts, with millions of dollars stolen from customers' credit card accounts. Citigroup acknowledged the hack attack and mentioned taking immediate action to rectify the situation and protect customers potentially at risk. The delay in sending out notification letters after the discovery of the breach could be seen as a lack of prompt response, possibly indicating a failure in handling the security problem efficiently [6198]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the provided article.
Duration permanent (a) The software failure incident in the article is more of a permanent nature. The hack attack on Citigroup resulted in the theft of millions of dollars from customers' credit card accounts. The breach affected a significant number of accounts, with over 360,000 accounts being accessed by the hackers. Citigroup took immediate action to rectify the situation and protect customers potentially at risk, but the incident itself was a permanent breach that led to financial losses for some customers [6198].
Behaviour crash, omission, other (a) crash: The software failure incident in the article can be categorized as a crash as it resulted in the system losing state and not performing its intended functions. The hack attack on Citigroup's system led to the theft of millions of dollars from customers' credit card accounts, indicating a significant disruption in the system's normal operation [6198]. (b) omission: The incident can also be linked to omission as the system omitted to perform its intended functions at an instance(s). Specifically, the hackers were able to access a large number of accounts, but only a small percentage of those accounts had money removed from them, indicating that the system failed to prevent unauthorized access and transactions on a substantial number of accounts [6198]. (c) timing: There is no clear indication in the article that the software failure incident was related to timing issues where the system performed its intended functions too late or too early. (d) value: The incident does not directly point to a failure due to the system performing its intended functions incorrectly. The primary issue was the unauthorized access and theft of funds rather than the system providing incorrect outputs or results. (e) byzantine: The software failure incident does not align with a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The hack attack resulted in a clear and consistent outcome of funds being stolen from accounts. (f) other: The other behavior observed in this software failure incident could be categorized as a security breach. The incident involved a deliberate attack by hackers to gain unauthorized access to customer accounts and steal funds, highlighting a breach in the system's security measures [6198].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident at Citigroup resulted in a hack attack where approximately $2.7 million was stolen from about 3,400 accounts, out of a total of 360,083 accounts that were accessed by hackers. While fewer than 1% of the hacked accounts had money removed from them, this incident led to financial losses for the affected customers. Citigroup took action to rectify the situation and protect customers from further financial harm, issuing new credit cards to over 200,000 hacked customers and ensuring that customers would not be held liable for any fraud on their accounts [6198].
Domain finance (a) The software failure incident reported in Article 6198 is related to the finance industry. Citigroup, a major financial institution, experienced a hack attack that resulted in the theft of millions of dollars from customers' credit card accounts [6198]. The incident involved unauthorized access to customer accounts and the subsequent theft of funds, highlighting the vulnerability of financial systems to cyber attacks. Additionally, the article mentions that Citigroup took measures to issue new credit cards to affected customers and reassured them that they would not be held liable for any fraudulent activities on their accounts.

Sources

Back to List