IMF: Cyberattacks have more than doubled since the pandemic. „Attacks on financial firms account for nearly one-fifth of the total, of which banks are the most exposed.”

The financial sector has suffered more than 20,000 cyberattacks, causing $12 billion in losses, over the past 20 years.

While companies have historically suffered relatively modest direct losses from cyberattacks, some have experienced a much heavier toll. US credit reporting agency Equifax, for example, paid more than $1 billion in penalties after a major data breach in 2017 that affected about 150 million consumers.

As we show in a chapter of the April 2024 Global Financial Stability Report, the risk of extreme losses from cyber incidents is increasing. Such losses could potentially cause funding problems for companies and even jeopardize their solvency. The size of these extreme losses has more than quadrupled since 2017 to $2.5 billion. And indirect losses like reputational damage or security upgrades are substantially higher.

The financial sector is uniquely exposed to cyber risk. Financial firms—given the large amounts of sensitive data and transactions they handle—are often targeted by criminals seeking to steal money or disrupt economic activity. Attacks on financial firms account for nearly one-fifth of the total, of which banks are the most exposed.

Incidents in the financial sector could threaten financial and economic stability if they erode confidence in the financial system, disrupt critical services, or cause spillovers to other institutions.

For example, a severe incident at a financial institution could undermine trust and, in extreme cases, lead to market selloffs or runs on banks. Although no significant “cyber runs” have occurred thus far, our analysis suggests modest and somewhat persistent deposit outflows have occurred at smaller US banks after a cyberattack.

Cyber incidents that disrupt critical services like payment networks could also severely affect economic activity. For example, a December attack at the Central Bank of Lesotho disrupted the national payment system, preventing transactions by domestic banks.

Another consideration is that financial firms increasingly rely on third-party IT service providers, and may do so even more with the emerging role of artificial intelligence. Such external providers can improve operational resilience, but also expose the financial industry to systemwide shocks. For example, a 2023 ransomware attack on a cloud IT service provider caused simultaneous outages at 60 US credit unions.

With the global financial system facing significant and growing cyber risks from increasing digitalization and geopolitical tensions, as shown in the chapter, policies and governance frameworks at firms must keep pace.

Because private incentives may be insufficient to address cyber risks—for example, firms may not fully account for the systemwide effects of incidents—public intervention may be necessary.

However, according to an IMF survey of central banks and supervisory authorities, cybersecurity policy frameworks, especially in emerging market and developing economies, often remain insufficient. For example, only about half of countries surveyed had a national, financial sector-focused cybersecurity strategy or dedicated cybersecurity regulations.

More details here