Jack Henry confirms a vishing-led breach of its corporate network

The US core banking and payments vendor says attackers reached an internal, non-production environment through a voice-phishing call and took personal data belonging to fewer than ten of its 7,200 client institutions. Core platforms and daily processing were not touched. What changed Jack Henry detected an intrusion confined to a limited part of its internal corporate estate. It states that no client-facing systems, operating systems, core platforms or daily processing services were accessed or disrupted, and that there were no outages. Personally identifiable information belonging to fewer than ten client institutions was affected; all 7,200 clients were notified that an incident occurred, and the affected institutions are being worked with directly. The entry point was a social engineering call — vishing — attributed to the ShinyHunters extortion group. Jack Henry engaged an outside forensics firm, is cooperating with federal law enforcement, is refusing to pay the extortion demand, and says the incident is not financially material. Two years of credit monitoring is being offered to affected institutions to pass on to their accountholders.