<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>Cyberattack Case Library: Financial Services Sector Feed</title>
    <link>https://cybercaselibrary.com/sectors/financial-services/</link>
    <description>Targeted cyberattack dossiers, wire fraud schemes, and banking intrusions compiled from primary federal indictments.</description>
    <language>en-us</language>
    <lastBuildDate>Fri, 02 Oct 2026 20:02:15 GMT</lastBuildDate>
    <atom:link href="https://cybercaselibrary.com/feeds/financial-services.xml" rel="self" type="application/rss+xml"/>
    
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Khoroshev et al. (LockBit Ransomware Operation)]]></title>
      <link>https://cybercaselibrary.com/cases/lockbit-ransomware-takedown/</link>
      <guid>https://cybercaselibrary.com/cases/lockbit-ransomware-takedown/</guid>
      <description><![CDATA[Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Tue, 07 May 2024 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Yakubets & Turashev (Evil Corp / Dridex Banking Malware)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-yakubets-evil-corp-dridex/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-yakubets-evil-corp-dridex/</guid>
      <description><![CDATA[Leader and core administrator of Evil Corp charged with deploying Bugat/Dridex banking malware and ransomware, stealing dozens of millions of dollars from bank accounts of municipalities, school districts, and businesses.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Thu, 14 Nov 2019 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-park-jin-hyok-lazarus/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-park-jin-hyok-lazarus/</guid>
      <description><![CDATA[Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Fri, 08 Jun 2018 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Albert Gonzalez (TJX & Heartland Payment Systems)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-albert-gonzalez-tjx-heartland/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-albert-gonzalez-tjx-heartland/</guid>
      <description><![CDATA[Mastermind of the largest credit card theft operation in history at the time, hacking TJX Companies, BJ's Wholesale Club, OfficeMax, and Heartland Payment Systems, stealing over 130 million payment cards.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Tue, 05 Aug 2008 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Andrei Tyurin (JPMorgan Chase Data Breach)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-tyurin-jpmorgan-chase/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-tyurin-jpmorgan-chase/</guid>
      <description><![CDATA[Russian hacker who penetrated JPMorgan Chase and eleven other major U.S. financial institutions and media companies, stealing personal data belonging to over 100 million customers to fuel securities pump-and-dump schemes.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Tue, 10 Nov 2015 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Paige Thompson (Capital One Cloud Breach)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-thompson-capital-one-breach/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-thompson-capital-one-breach/</guid>
      <description><![CDATA[Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Mon, 29 Jul 2019 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Anatoly Legkodymov (Bitzlato Cryptocurrency Laundering)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-legkodymov-bitzlato/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-legkodymov-bitzlato/</guid>
      <description><![CDATA[Founder of Hong Kong-registered cryptocurrency exchange Bitzlato charged with laundering over $700 million in ransomware and darknet market illicit proceeds, serving as a primary financial conduit for Hydra Market.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Tue, 17 Jan 2023 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: Operation Cookie Monster (Genesis Market Takedown)]]></title>
      <link>https://cybercaselibrary.com/cases/genesis-market-takedown-cookie-monster/</link>
      <guid>https://cybercaselibrary.com/cases/genesis-market-takedown-cookie-monster/</guid>
      <description><![CDATA[Coordinated multinational takedown of Genesis Market, the world's most prominent illicit broker of stolen digital browser fingerprints, cookies, and compromised account credentials.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Tue, 04 Apr 2023 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Minh Quoc Nguyen (ChipMixer Cryptocurrency Mixer)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-nguyen-chipmixer/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-nguyen-chipmixer/</guid>
      <description><![CDATA[Operator of ChipMixer, one of the dark web's largest unlicensed cryptocurrency mixing services, charged with laundering more than $3 billion in Bitcoin associated with ransomware, North Korean state hackers, and darknet drug markets.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Wed, 15 Mar 2023 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Alla Witte & Vladimir Dunaev (Trickbot Malware Group)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-witte-dunaev-trickbot/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-witte-dunaev-trickbot/</guid>
      <description><![CDATA[Key software developers and coders of the transnational Trickbot cybercrime group charged with infecting millions of victim computers with banking trojans and facilitating Conti/Ryuk ransomware deployments against hospitals.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Thu, 18 Feb 2021 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Marcus Hutchins (Kronos Banking Malware)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-hutchins-kronos-malware/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-hutchins-kronos-malware/</guid>
      <description><![CDATA[British malware researcher who previously halted the global WannaCry ransomware outbreak charged with authoring the Kronos banking trojan and UPAS kit years earlier as a teenager.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Wed, 12 Jul 2017 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Aleksandr Brovko (Botnet Parsing & Credential Sales)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-brovko-botnet-logs/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-brovko-botnet-logs/</guid>
      <description><![CDATA[Russian national who developed automated scripts to parse botnet logs, extracting financial information and account credentials from thousands of victim computers and marketing them on cybercrime forums.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Wed, 12 Feb 2020 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Sergey Medvedev et al. (Infraud Organization)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-medvedev-infraud-organization/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-medvedev-infraud-organization/</guid>
      <description><![CDATA[Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Fri, 26 Jan 2018 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Brett Johnson (ShadowCrew Cybercrime Syndicate)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-johnson-shadowcrew/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-johnson-shadowcrew/</guid>
      <description><![CDATA[Pioneering cybercriminal known as 'The Original Internet Godfather' who built and operated ShadowCrew, the prototypical dark web marketplace for trafficking in stolen identities and credit card data.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Tue, 26 Oct 2004 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Max Ray Vision (Iceman / CardersMarket)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-vision-cardersmarket/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-vision-cardersmarket/</guid>
      <description><![CDATA[Former white-hat computer security analyst turned master cybercriminal who operated CardersMarket, hacking rival criminal forums to steal their user databases and monopolize illicit credit card trafficking.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Mon, 10 Sep 2007 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Denis Gennadievich Kulkov (Try2Check Card Checking Service)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-kulkov-try2check/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-kulkov-try2check/</guid>
      <description><![CDATA[Creator of Try2Check, the preeminent criminal card-checking platform that processed tens of millions of card verification requests annually for cybercriminals buying stolen credit cards.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Tue, 18 Apr 2023 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Rui-Siang Siew (Incognito Market Darknet Extortion)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-siew-incognito-market/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-siew-incognito-market/</guid>
      <description><![CDATA[Owner and operator of Incognito Market who facilitated over $100 million in illicit darknet transactions before orchestrating an exit scam and extorting registered vendors and buyers with doxxing threats.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Mon, 20 May 2024 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Maksim Boiko (QQAAZZ Cyber Laundering Network)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-boiko-qqaazz-laundering/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-boiko-qqaazz-laundering/</guid>
      <description><![CDATA[Russian cryptocurrency trader and Instagram influencer who operated as a high-level money launderer for QQAAZZ, an all-in-one cashout network servicing Dridex, Trickbot, and BitPaymer ransomware gangs.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Tue, 15 Sep 2020 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: Snowflake Customer Multi-Tenant Credential Stuffing Campaign]]></title>
      <link>https://cybercaselibrary.com/cases/snowflake-multi-tenant-credential-attacks/</link>
      <guid>https://cybercaselibrary.com/cases/snowflake-multi-tenant-credential-attacks/</guid>
      <description><![CDATA[Coordinated cybercrime campaign targeting over 165 corporate customer tenants of cloud database provider Snowflake using credentials harvested by infostealer malware, exfiltrating billions of consumer records from Ticketmaster, Santander, and AT&T.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Fri, 31 May 2024 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. James Zhong (Silk Road 50,000 Bitcoin Theft)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-zhong-silk-road-bitcoin-seizure/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-zhong-silk-road-bitcoin-seizure/</guid>
      <description><![CDATA[Historic seizure of over 50,676 Bitcoins ($3.36 billion at seizure) hidden in an underground floor safe and popcorn tin, stolen by James Zhong from the Silk Road darknet market in 2012 by triggering race conditions in the withdrawal logic.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Fri, 04 Nov 2022 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Ilya Lichtenstein & Heather Morgan (Bitfinex Hack & Laundering)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-lichtenstein-bitfinex-heist-laundering/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-lichtenstein-bitfinex-heist-laundering/</guid>
      <description><![CDATA[Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Mon, 07 Feb 2022 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Wu et al. (Equifax PLA Unit 54th Research Institute)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-wu-equifax-pla/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-wu-equifax-pla/</guid>
      <description><![CDATA[Four military officers with the Chinese People's Liberation Army (PLA) 54th Research Institute charged with hacking into Equifax networks, stealing trade secrets, and exfiltrating personally identifiable information (PII) of roughly 147 million American citizens.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Tue, 28 Jan 2020 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: Target Corporation Point-of-Sale Data Breach (Fazio Mechanical Ingress)]]></title>
      <link>https://cybercaselibrary.com/cases/target-corporation-hvac-breach/</link>
      <guid>https://cybercaselibrary.com/cases/target-corporation-hvac-breach/</guid>
      <description><![CDATA[Landmark retail cyberattack where attackers penetrated Target internal corporate networks using stolen billing portal credentials from a third-party refrigeration and HVAC vendor, subsequently deploying BlackPOS memory scraping malware to steal 40 million credit card numbers and 70 million customer records.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Wed, 02 Apr 2014 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: U.S. v. Paige Thompson (Capital One AWS Cloud SSRF Breach)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-thompson-capital-one/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-thompson-capital-one/</guid>
      <description><![CDATA[Former Amazon Web Services systems engineer convicted under the Computer Fraud and Abuse Act for exploiting a misconfigured open-source Web Application Firewall (WAF) using Server-Side Request Forgery (SSRF) to query AWS metadata services and steal over 100 million credit card applications from Capital One.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Wed, 28 Aug 2019 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: State of Florida v. Graham Ivan Clark (Twitter VIP Bitcoin Hijack)]]></title>
      <link>https://cybercaselibrary.com/cases/us-v-clark-twitter-bitcoin/</link>
      <guid>https://cybercaselibrary.com/cases/us-v-clark-twitter-bitcoin/</guid>
      <description><![CDATA[17-year-old hacker orchestrated a spearphishing and social engineering scheme targeting Twitter employees, gaining access to internal administrative customer service tools and hijacking 130 high-profile verified accounts (including Joe Biden, Barack Obama, Elon Musk, and Apple) to promote a fraudulent Bitcoin giveaway.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Fri, 31 Jul 2020 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: Change Healthcare Ransomware Outage (ALPHV / BlackCat)]]></title>
      <link>https://cybercaselibrary.com/cases/change-healthcare-blackcat-ransomware/</link>
      <guid>https://cybercaselibrary.com/cases/change-healthcare-blackcat-ransomware/</guid>
      <description><![CDATA[Nationwide healthcare billing and pharmacy clearinghouse paralyzed by an ALPHV/BlackCat ransomware deployment. Threat actors gained initial access through an unmonitored Citrix portal server lacking multi-factor authentication, exfiltrating 6 terabytes of protected health data and forcing a 350 Bitcoin ($22 million) extortion payout amidst an estimated $3+ billion systemic recovery cost.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Wed, 21 Feb 2024 00:00:00 GMT</pubDate>
    </item>
  
    <item>
      <title><![CDATA[Financial Sector Incident: Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts]]></title>
      <link>https://cybercaselibrary.com/cases/snowflake-customer-credential-theft/</link>
      <guid>https://cybercaselibrary.com/cases/snowflake-customer-credential-theft/</guid>
      <description><![CDATA[Financially motivated threat actor collective UNC5537 systematically infiltrated over 165 corporate customer tenants hosted on Snowflake (including Ticketmaster, Santander Bank, Advance Auto Parts, and LendingTree). Attackers leveraged infostealer malware logs dating back years against enterprise user accounts that lacked multi-factor authentication and IP network allowlists, exfiltrating billions of consumer records.]]></description>
      <category><![CDATA[Financial Services & Banking]]></category>
      <pubDate>Thu, 23 May 2024 00:00:00 GMT</pubDate>
    </item>
  
  </channel>
</rss>