{"id":2692,"date":"2025-04-09T01:13:55","date_gmt":"2025-04-09T01:13:55","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=2692"},"modified":"2025-04-09T01:13:55","modified_gmt":"2025-04-09T01:13:55","slug":"us-bank-regulators-email-system-breached","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=2692","title":{"rendered":"US bank regulator\u2019s email system breached"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A cyber intrusion at the US Office of the Comptroller of the Currency (OCC) is \u201cmassively serious\u201d and comes at a time when \u201cthe good work done to improve cybersecurity in the US is under extraordinary pressure,\u201d a security analyst said Tuesday.<\/p>\n

David Shipley, head of Canadian security awareness training provider Beauceron Security, was responding to an alert issued by the OCC, an independent bureau of the Department of Treasury which charters, regulates, and supervises all national banks in the US.<\/p>\n

According to a release<\/a>, it has notified Congress of what it described as a \u201cmajor information security incident,\u201d which it is required to do under the Federal Security Modernization Act (FISMA<\/a>)<\/a>.<\/p>\n

The release noted that \u201cthis finding is the result of internal and independent third-party reviews of OCC emails and email attachments that were subject to unauthorized access. On February 11, 2025, the OCC learned of unusual interactions between a system administrative account in its office automation environment and OCC user mailboxes.\u201d<\/p>\n

It went on to state, \u201con February 12, the OCC confirmed the activity was unauthorized and immediately activated its incident response protocols, which include initiating an independent third-party incident assessment and reporting the incident to the Cybersecurity and Infrastructure Security Agency. On February 12, the OCC disabled the compromised administrative accounts and confirmed that the unauthorized access had been terminated. The OCC provided public notice<\/a> of the incident on February 26.\u201d<\/p>\n

One published report released Tuesday indicated<\/a>, \u201cunknown attackers who breached the Treasury\u2019s Office of the Comptroller of the Currency (OCC) in June 2023 gained access to over 150,000 emails.\u201d<\/p>\n

Shipley responded to that by saying the best case scenario for the OCC and the national banking industry in general is they might get \u201cvery, very, very lucky\u201d if it turns out to be a nation state simply doing spying and preparatory work.<\/p>\n

The worst case scenario is that an OCC regulated entity, or entities, were breached as a result of the email compromise, he said.<\/p>\n

\u201cIt\u2019s stunning, and this is coming at a time when the good work done to improve cybersecurity in the United States is under extraordinary pressures, both to limit the regulatory gains and insight, and also just the resources to go after this.\u201d<\/p>\n

Shipley added that \u201cif this is not a canary in the coal mine of an immediate U turn required in investing in protecting the critical infrastructure of the United States, I don\u2019t know what is. And we absolutely need a full, transparent accounting of this so that we can learn from it.\u201d\u00a0<\/p>\n

And the fact that the OCC is a regulator, he said, \u201cdoes not mean that it was appropriately resourced to protect itself. I think a big question that needs to be asked is, are these extraordinarily important agencies appropriately resourced to protect themselves? And odds are, if you scratch the surface and dig, you\u2019re going to find extraordinarily stretched IT teams, overworked, with inadequate funding to protect themselves. It is deeply ironic, but it would not be surprising to me.\u201d<\/p>\n

As for who masterminded the incident, Shipley said that whoever it is \u201cis really, really audacious to go after the Department of the Treasury. Remember, this is where the Secret Service lives. Secret Service investigates financial cyber crime. You are poking one of the best resourced bears on the planet. But that should tell you something. Someone felt bold enough to pull this off, and pulled it off for a long time, and that should scare people.\u201d<\/p>\n

In an emailed statement Tuesday night, an OCC spokesperson said that the agency learned of the unauthorized access to its email system the day after the Acting Comptroller of the Currency, Rodney E. Hood, was sworn into office.<\/p>\n

On February 25, Hood \u201creceived a high-level briefing of this incident, and the OCC provided public notice of the incident the following day. At that time, Mr. Hood had not been provided detailed information about the full duration of the unauthorized access, nor the specific number and content of email communications affected,\u201d the spokesperson said, noting that the OCC has utilized third-part cybersecurity experts to perform a full review of the investigation and forensics efforts.<\/p>\n

\u201cThe OCC operates a comprehensive information security and cyber protection program to protect its critical information recourses, including the sensitive financial institution information in its custody,\u201d the spokesperson said.<\/p>\n

The agency, they said, implements security and privacy controls that meet or exceed National Institute of Standards and Technology standards, and continually assesses those controls to evaluate their effectiveness.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A cyber intrusion at the US Office of the Comptroller of the Currency (OCC) is \u201cmassively serious\u201d and comes at a time when \u201cthe good work done to improve cybersecurity in the US is under extraordinary pressure,\u201d a security analyst said Tuesday. David Shipley, head of Canadian security awareness training provider Beauceron Security, was responding […]<\/p>\n","protected":false},"author":0,"featured_media":2685,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2692","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2692"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2692"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2692\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/2685"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}