U.S. v. Andrei Tyurin (JPMorgan Chase Data Breach)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the Southern District of New York.
- Primary Target Sector: Financial Services, Banking, Publishing.
- Documented Financial Loss: $19.0 million.
- 2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Russian hacker who penetrated JPMorgan Chase and eleven other major U.S. financial institutions and media companies, stealing personal data belonging to over 100 million customers to fuel securities pump-and-dump schemes.
Root Cause & Infiltration Vector
Adversary gained initial access via Exploit Public-Facing Application: Tyurin gained entry to JPMorgan Chase's network by exploiting an unpatched web application server lacking two-factor authentication.
Operational Impact & Financial Blast Radius
Resulted in $19,000,000 in documented financial liabilities. Court ordered $19,952,861 in restitution to victim financial institutions.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Tyurin gained entry to JPMorgan Chase's network by exploiting an unpatched web application server lacking two-factor authentication.
Exfiltrated contact records of 83 million individual and small business accounts, the largest single corporate breach of a U.S. bank at the time.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Financial Services, Banking, Publishing infrastructure.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Extradited from the Republic of Georgia to the Southern District of New York.
Pleads guilty to computer intrusion, wire fraud, bank fraud, and illegal gambling conspiracies.
Sentenced to 144 months (12 years) in federal prison and ordered to forfeit $19,214,956.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Andrei Tyurin | Russian Federation | sentenced | 144 mo | None | Perpetrator of JPMorgan Chase 83-million-customer data intrusion. Sentenced to 144 months in prison. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1190 | Exploit Public-Facing Application Initial Access | "Tyurin gained entry to JPMorgan Chase's network by exploiting an unpatched web application server lacking two-factor authentication." | Indictment ¶ 12, Page 6 | reviewed |
| T1041 | Exfiltration Over C2 Channel Exfiltration | "Exfiltrated contact records of 83 million individual and small business accounts, the largest single corporate breach of a U.S. bank at the time." | Indictment ¶ 15, Page 8 | reviewed |