Attacks on corporate IT systems or financial market infrastructures involving the use of malware, for example, are on the increase worldwide (see Figure 1). According to estimates of the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik – BSI), the threat has never been so great. This also applies to the financial sector as the companies operating in this sector are working with two especially attractive goods – money and sensitive data. Cyberattacks have the potential to inflict enormous damage on the companies affected, but they can also substantially restrict the ability of the financial system to operate and endanger financial stability. This is also the case if the targets of such attacks are not the companies themselves but their service providers and, in particular, major multi-client service providers¹. DRansomware attacks pose the most serious threat. This is a computer malware that encrypts the victim’s data and only releases it after payment of a ransom. Another variant of such an attack is when criminals extract data via ransomware and threaten to publish the data unless a ransom is paid. Collateral damage can be caused if systems have to be shut down.

Figure 1: Average daily growth of new malware variants

Source: Federal Office for Information Security (BSI), The State of IT Security in Germany

Examples from 2023 have shown how quickly such attacks can impact the ability of sections of the financial market to operate. In the USA, an institution in the clearing chain for trades in US Treasuries was a victim of such an attack. This institution’s sole purpose was to act as one of several points in the clearing chain for the US market. But due to the strong infrastructural links between the institution and other market participants, the entire trading and clearing activities of the customers affected were greatly restricted as a result of the cyber attack. It was only possible to avoid major upheavals in the trading segments affected by the attacks by performing complex alternative processes manually. Examples from Germany also highlight the damage potential and risks: in one case, data of bank customers at a service provider responsible for managing account changes were siphoned off. In another case, a supervised company that works together with numerous credit institutions had to shut down its server for a longer period of time due to a cyber attack. During this period, the company was unable to carry out any new business and had to complete each procedure on paper, involving a great deal of manual work. What is more, the attackers extorted personal data held by the company, which it later published on the darknet. Such dealings are known as double extortion.

Another frequent form of attack is the distributed denial of service (DDoS). This involves engulfing the communications networks of a company with data requests. The use of malware or spyware in the form of Trojans, viruses or worms is also on the increase.

The increasing spread of digitalisation has broadened the range for attacks. At the same time, the threat is exacerbated by the activities of effectively organised economic criminals and by cyberattacks that are politically motivated or even government influenced. The latest geopolitical tensions and crises are further heightening the risk of government-influenced cyberattacks, including attacks on the public administration and operators of critical infrastructure in the finance area.

1 See Risks arising from market concentration due to the outsourcing of IT services .

More articles

Risks in BaFin's Focus 2024
Foreword by the President

Main Risks in BaFin’s Focus

1. Risks arising from significant increases in interest rates
2. Risks arising from corrections on the real estate markets
3. Risks arising from significant corrections on the international financial markets
4. Risks arising from defaults on loans to German companies
6. Risks arising from inadequate money laundering prevention
7. Risks arising from market concentration due to the outsourcing of IT services

Trends

1. Digitalisation
2. Sustainability
3. Geopolitical turmoil

Download

Complete edition Risks in BaFin’s Focus 2024