Along with the healthcare sector, the financial industry remains a huge target for cyber thieves, gangs, and bad actors looking to cash in on the cybersecurity flaws and vulnerabilities of banks and other financial institutions.
Because financial institutions rely on digital technology to manage and process financial transactions, top-tier cybersecurity is critical in an age of more organized and sophisticated attacks.
How critical? Here are some recent and unsettling numbers from the research team at Comparitech, a pro-consumer website:
- Financial data breaches account for 153.3 million leaked records from 2018 to 2022.
- 153,334,145 individual records were affected because of these breaches.
- 2022 was the biggest year for the median number of records (3,633) impacted by financial data breaches.
- Hacking was the most common type of breach, accounting for over 50 percent of breaches.
- Ransomware attacks are a growing threat for financial data breaches, significantly increasing in recent years.
Citing a report from the FBI, American Banker reports that phishing was the most common type of internet crime, ensnaring 320,000 victims last year and $44 million in losses. American Banker also says financial institutions are the most impersonated brands in phishing scams.
Not surprisingly, attacks on banks have also made headlines. The following are some recent news stories:
- In February 2021, the Reserve Bank of New Zealand was hit by a cyber-attack that caused considerable service disruption. The Guardian reported that a state-sponsored hacker group planned the assault.
- In April 2022, National Mortgage News reported that Lakeview Loan Servicing, the fourth-largest mortgage loan servicer in the United States, sustained a data breach. It affected more than 2.5 million consumers, exposing account numbers, including credit and debit card numbers.
- In June 2022, Flagstar Bank, one of America’s largest banks, suffered a significant data breach impacting more than 1.5 million customers, Infosecurity Magazine reported.
These are three of many cyberattacks on banks and financial institutions over the past two years, underscoring the magnitude of this ongoing onslaught.
Why Banks and Financial Institutions are Targeted
Because they house valuable financial data, including personal and financial information of customers, transaction histories, and account details, banks and financial institutions remain primary prey. Bad actors and groups use fraudulent schemes such as money laundering, phishing, ransomware, and identity theft to gain access to sensitive data for potentially big economic bounties.
In addition, the often-complex architectures of banks with multiple integrated systems, high profiles, reputations, and regulatory demands can make them at risk for cyberattacks that result in loss of customer trust, data breaches, and financial loss. With this rocky landscape in mind, banks and financial institutions must put a premium on cybersecurity and focus on solid security steps to safeguard their businesses and customers from cybersecurity attacks.
Here are some possible threats/vulnerable areas that banks and financial institutions must address to keep their customer data more secure.
Ransomware
In a notice released last year, the Payment Card Industry Security Standards Council, formed by Mastercard, Visa, and other major credit card companies three decades ago, warned that ransomware is a burgeoning threat to banks. The alert came with good reason, and banks detected a record $886 million in ransomware payments in 2021.
To staunch the financial bleeding, institutions need to implement comprehensive plans including employee training and awareness, robust endpoint protections, regular data backups, access control, frequent cybersecurity audits, and incident response procedures and plans. In this video guide, Spiceworks provides steps enterprises and banks can take to mitigate ransomware.
Software Weaknesses
Taking advantage of publicly known shortcomings in a bank’s software is one of the most effective attack strategies cybercriminals can deploy. Unfortunately, this often succeeds because banks do not update software regularly and on time, allowing online thieves to exploit security weaknesses that could have been averted. By ignoring these vulnerabilities that can and should be closed, banks leave themselves open to potential threats.
In 2022, the Consumer Financial Protection Bureau (CFPB) released a bulletin calling on banks to upgrade their defenses against this cybersecurity attack. Failure to implement timely security precautions could lead to legal liability for banks if they do not effectively protect consumer information. The CFPB also emphasized that banks must prioritize stronger password management and multi factor authentication.
Inadequate Password Security
Password managers have garnered negative attention after a cyberattack that breached LastPass and compromised customer information in 2022. Individuals should still use password managers, even if it isn’t LastPass.
In an interview last August, the chief information security manager at Navy Federal Credit Union encouraged the use of password managers. While banks want passwordless authentication, robust and different passwords remain critical, and people need a way to store and manage this data.
Talent Shortage in Cybersecurity
The need for cybersecurity talent is outdistancing the rate people enter the industry. While not an immediate threat as phishing or weak passwords, this talent deficit constitutes a security risk for banks, noted in a recent report by the Carnegie Endowment for International Peace.
There is an argument among cybersecurity experts on the optimal approach for banks to address this issue. Some believe in focusing on upskilling and training current employees, while others say attracting recruits is the right path. Whatever road a bank selects, it is vital to prioritize training and education to ensure bank staff have the skills to stay abreast of evolving attacks.
Partner Cybersecurity Gaps
Cybercriminals have often accessed companies and governments by focusing on technology vendors. The most high-profile hack occurred three years ago when Russian-backed attackers breached thousands of organizations using malicious code inside Solarwinds’ system management software updates.
Banks and other financial institutions need service providers to manage their operations. However, these partnerships pose cybersecurity challenges. According to a survey conducted among cybersecurity professionals, 60 percent of financial institutions had a cyberattack outside their organization in 2022. Make no mistake about it. Banks remain vulnerable to attacks if they rely on third-party vendors to safeguard their data.
The Increase in video conference banking
Covid-19 increased the number of video banking interactions among financial institutions with the technology already in place. Before Covid-19, fewer banks and credit unions used a video banking platform.
However, as Covid-19 forced the closure of branches and limited brick-and-mortar visits, banks globally started to embrace and adopt alternatives to in-person visits. Cyber risks for banks and other financial institutions have grown in recent years, as this Carnegie Endowment for International Peace timeline shows. While video banking has advantages, challenges such as security, compliance, cost, and customer preparedness remain. The bottom line: Sensitive information needs to stay private.
To meet the challenges of video banking security, financial entities can leverage advanced cybersecurity solutions like War Room by VirnetX. With its best-in-class encryption technology, War Room enables banks to conduct private and secure video banking meetings with their customers and clients, protecting sensitive data from bad actors.
Count on VirnetX for Complete Cybersecurity
Banks and financial institutions face various cybersecurity threats and vulnerable spots they must investigate to guard their customers’ sensitive data. Threats like phishing, ransomware, third-party risks, and internal perils. It is paramount that banks institute robust cybersecurity protocols and protections, including sophisticated encryption, multifactor authentication, and regular security audits, to shield their data and mitigate risks associated with cybersecurity attacks.
By taking a proactive path, banks can ensure their customers’ confidential data remains safe from cyber thieves.
Safeguarding the sensitive data in the financial sector requires knowledge, education, detailed planning, and technical skill. We hope these insights help your organization avoid data theft and loss threats. As a solutions-focused company with patented technology, you can count on us for leading-edge, top-tier cybersecurity. For more information, please visit https://virnetx.com/.
About VirnetX
VirnetX Holding Corporation is an Internet security software and technology company with patented technology for secure communications, including 4G LTE and 5G security. VirnetX’s software and technology solutions, including its secure domain name registry and Gabriel Connection Technology™, are designed to facilitate secure communications and to create a safe environment for real-time communication applications such as instant messaging, VoIP, smartphones, e-readers, and video conferencing. The Company’s patent portfolio includes over 200 U.S. and foreign-granted patents, validations, and pending applications. For more information, please visit www.virnetx.com.
