Profiling the victim - cyber risk in commercial banks

• Published in: Computers & security 2025-03, Vol.150, Article 104274
• Main Author: Smaga, Paweł
• Format: Article
• Language: English
• Subjects: Bank; Cyber risk; Cyberwarfare; Financial stability; Hackers; Security; War
• ISSN: 0167-4048
• DOI: 10.1016/j.cose.2024.104274

The aim of this study is to identify the commonalities in financial characteristics of banks targeted in cyber attacks in recent years. This required merging the databases with reported cyber incidents (from 01.01.2020 until 09.10.2024) with financial data on banks’ condition before the attack, as well as macroeconomic cross-country data. Use of statistical analysis revealed two main trends in cyber attacks on a worldwide sample of 186 attacks on banks. First, criminals (such as the hacker group “Cl0p” targeting mostly US banks) driven by financial gain usually exploit IT vulnerabilities in smaller, less profitable and less resilient commercial and cooperative banks, adopting the “easy prey” strategy. Second, hacktivist attacks (usually by the Russian-linked “NoName057(16)”), which are politically motivated, attempt to disrupt operations of larger, more profitable and solvent commercial banks, in order to “send a message”. Profitability ratios seem to be the most important characteristic distinguishing banks targeted in cyber attacks. The number of cyber attacks on banks, especially financially-driven ones, has been increasing over recent years. There is a strong correlation between the actor type, their motive, and the type of cyber incident. Prevalent data gaps and the growing intensity of cyber attacks on banks point to urgent and relevant policy implications.