Two-Factor Authentication Blunder Was The Cause of JPMorgan Breach

It was the lack of two-factor authentication in JPMorgan's network servers that enabled hackers to steal data of about 83 million customers.

The attackers, reportedly stole login credentials of a JPMorgan employee and accessed the company servers.

Citing sources familiar with the investigation, NYTimes reported that the company's security team neglected to upgrade one of its network servers with a double authentication scheme, a very basic weak spot, which later was exploited by attackers.

JPMorgan spends around $250 million a year on computer security, the NYT report noted.

Two factors authentication combines the use of static passwords with one-time-use access codes. Had the two-factor authentication been put in place, the attack could have been stopped when it started as one-time-use access codes are generated by hardware devices or mobile apps.

In the attack, JPMorgan's customers' names, addresses, phone numbers and email addresses were compromised. Attackers also got the information about which line of business the customers were affiliated with.

The story is just another instance when a breach of a single server or employee computer can put the entire organization on risk.

Authorities earlier believed that Russian government was behind the attack due to US economic sanctions against Russia, but FBI had dropped the idea. A team of internal investigators is trying to get to the bottom of the attack and the organization behind it.