Cybersecurity Risk

Cybersecurity risk is the risk of financial loss, disruption, legal liability or damage to trust that arises from attacks on, or failures of, an organisation's computer systems, networks and data. For banks, payment companies and crypto firms it includes theft of funds, theft of customer data, ransomware that halts operations and fraudulent instructions sent through compromised systems.

Supervisors usually treat it as part of operational risk, but it now has its own frameworks, reporting rules and board-level oversight. It overlaps with data security, which protects information, and with data privacy, which governs how personal data may be used. In payments, card data protection is set by the Payment Card Industry Data Security Standard, while broader guidance comes from bodies such as the US National Institute of Standards and Technology (NIST).

Think of a house. Burglars might pick the lock, climb through an open window, or trick someone inside into opening the door. A fire in the fuse box could also shut everything down without anyone breaking in. Owners respond with locks, alarms, careful habits about who gets a key, and insurance, and they still accept that no house is perfectly safe.

A financial firm's systems are a house with thousands of doors: staff laptops, mobile apps, connections to partner banks, suppliers' software and cloud services. Cybersecurity risk is the chance that one of those doors is opened by the wrong person, or that the wiring fails, and money or data goes missing as a result. The job is to know where the doors are, lock the important ones well and notice quickly when one is forced.

• Phishing and social engineering. Phishing messages and other social engineering trick staff or customers into handing over passwords or approving payments; business email compromise uses this to redirect supplier payments.
• Credential theft and account takeover. Stolen logins lead to account takeover, sometimes helped by SIM swapping to intercept one-time codes.
• Ransomware. Ransomware encrypts systems and often steals data first, then demands payment, frequently in cryptocurrency.
• Denial of service. A distributed denial-of-service attack floods websites or payment interfaces so customers cannot use them.
• Supply-chain compromise. Attackers enter through a software vendor or service provider, which ties cybersecurity to third-party risk.
• Insider misuse. Employees or contractors abuse legitimate access, which is why firms limit privileges.

The 2016 theft from Bangladesh Bank is a well-known case: attackers who had compromised the bank's systems sent fraudulent payment instructions over SWIFT, and about US$81 million was moved out to accounts in the Philippines. SWIFT afterwards introduced its Customer Security Programme, which sets security controls that users must attest to.

NIST's Cybersecurity Framework 2.0, published on 26 February 2024, groups the work into six functions:

1. Govern. Set strategy, roles, policy and oversight, including risk from suppliers.
2. Identify. Know the systems, data and weaknesses the firm has.
3. Protect. Apply safeguards such as multi-factor authentication, access control, encryption, patching and security hardening.
4. Detect. Monitor for attacks, often through a security operations centre.
5. Respond. Contain incidents, communicate and report.
6. Recover. Restore systems from clean backups and learn lessons.

Common specific controls include least-privilege access through role-based access control, encrypted connections using Transport Layer Security, segregation of payment systems from office networks, staff training, penetration testing and cyber insurance. Firms also rank systems by importance, so that the payment engine and the ledger get stronger protection than, say, a marketing website.

• European Union. The Digital Operational Resilience Act (DORA) has applied since 17 January 2025 to banks, payment and e-money institutions, crypto-asset service providers and other financial entities. It requires an ICT risk management framework, classification and reporting of major ICT incidents, resilience testing and oversight of technology suppliers.
• United States. Banks are examined against interagency guidance, and since December 2023 listed companies must disclose a material cybersecurity incident on Form 8-K within four business days of deciding it is material, under rules from the Securities and Exchange Commission. New York's Department of Financial Services applies its own cybersecurity regulation (23 NYCRR Part 500) to firms it licenses.
• Data protection. Under the GDPR, a personal data breach must generally be reported to the supervisory authority within 72 hours of the firm becoming aware of it, where it is likely to put individuals at risk.
• Card payments. Merchants and processors that store or handle card data must meet PCI DSS, now in version 4.0.1, whose future-dated requirements became mandatory on 31 March 2025.

Cyber losses are hard to model because attacks change quickly and large events are rare. Firms use scenario analysis, for example a week-long ransomware outage of the core banking system, to estimate direct costs, lost revenue and customer compensation. They also track indicators such as unpatched critical systems, phishing-test failure rates and time to detect incidents. A successful attack often triggers reputational risk and regulatory action, so the total cost can be far larger than the money stolen. Within an overall risk management framework, the board is expected to understand the firm's main cyber exposures and decide how much risk it will accept.

• NIST Cybersecurity Framework
• Digital Operational Resilience Act (DORA)