Ransomware Attacks: A Major Threat to Banking and Finance Industry

Cybersecurity has become a paramount concern for organizations across all industries, but the sectors dealing with financial data and transactions are at the top. Banks and financial organizations face cybersecurity challenges due to their critical role in managing financial assets and the rapid adoption of mobile banking, IoT, and OT devices.

Beside this, the emergence of sophisticated cyber threats like ransomware attacks on financial institutions has been serious and prevalent over the past few years, along with other industries such as healthcare and manufacturing. A survey conducted by Sophos revealed that out of more than 300 IT and cybersecurity professionals within the financial sector, 64% said they were victims of a ransomware attack in 2023- a significant rise from 55% in 2022. This is alarming and intensifies the need for robust cybersecurity measures.

The following guide explains different ransomware families targeting the financial sector and their impacts. Read on to learn more about the ransomware attacks on financial services and what can be done to prevent them.

Understanding Ransomware Attacks

Ransomware is a lucrative type of malware that encrypts the victim's data, files, devices, or systems and demands a ransom for its recovery. These attacks typically involve a hacker infiltrating banks, credit unions, brokerage firms, and loan and insurance services' networks through various means, such as phishing emails, exploiting vulnerabilities in software systems, and compromised websites. Once inside, the attackers deploy the malware to lock customers' data, administrative files, and confidential records, rendering them inaccessible to the organizations.

The financial sector is an attractive target for ransomware attacks for many reasons, but here are the most prominent ones:

High Financial Gains

As financial institutions gather vast amounts of information about their clients, employees, and partners, they become an attractive target for ransomware attacks. By locking sensitive data, such as credit card numbers, bank account details, SSNs, wills, and even estate documents, attackers can demand hefty ransom payments or threaten them to leak the stolen data online or on illegal marketplaces. Privacy Affairs' Dark Web Index 2022 found that an individual's banking and credit card credentials are available for purchase at a low cost, between $10 and $100. This shows hackers are after banks and other financial institutions' data to make big payouts.

Recently, the prolific ransomware gang LockBit broke into one of India's top brokerage firms, Motilal Oswal, to its dark web leak site, potentially risking the confidential data of over six million clients. However, the company still needs to provide more details about this event.

Growth in IoT and Digital Transactions

IoT has significantly impacted the banking and finance industry, with its market size expected to rise by 50.10% between 2023 and 2030. Integrating IoT in banking operations like mobile banking applications, smart ATMs, smart wallets, smart wearables, and smart branches has improved efficiency while reducing costs. For instance, Citibank and many other banks across the globe have transformed the ATM experience by incorporating beacons for smartphone-enabled access into their machines. As a result, customers can quickly deposit cash, withdraw cash, and manage their accounts by tapping on their phones, ensuring a seamless experience.

Similarly, IoT technology enables data collection in real-time. Banks use this feature to offer customized service and send customers notifications and updates with necessary information. Despite all these benefits, IoT devices are another key reason why the financial sector falls a target for ransomware attacks.

Hackers can launch ransomware attacks by exploiting the weak entry points within IoT devices leading to the networks of banking or finance organizations. Hackers can use automated tools to crack passwords or send phishing emails on many devices that use default or weak passwords. In addition, they may physically tamper with IoT devices like ATMs or POS terminals to install malware and gain control over their devices and network. Attackers can also exploit the vulnerabilities of IoT devices with outdated firmware or rely on third-party suppliers to gain unauthorized access and lock sensitive data. Prominent examples include a ransomware attack on MOVEit file transfer software that impacted 837,000 customers (about half the population of Idaho) by exposing their personal information, such as names, addresses, tax records, SSNs, and phone numbers.

Rise in State-Sponsored Actors

With the changing geopolitical and socio-economic conditions, targeting the financial and banking sector by leveraging sophisticated and well-funded threat actors continues to be a prime concern. Nation-states or governments often back up state-sponsored actors with ample resources and advanced technical capabilities to target the finance sector. The motivation for these attacks goes beyond gaining lump sum money or stealing personal data and aims to disrupt financial systems and gain economic advantages for political purposes.

For instance, Russian-based cybercriminal Lockbit launched a ransomware attack on the Dublin-based fintech firm. The attack disrupted transactions for several major US and European clients and affected financial markets as the victims were forced to close critical servers.

Safeguarding the Finance Industry from Ransomware Attacks

A ransomware attack on banking and financial services leads to economic losses, regulatory penalties, service disruption, and damage to reputation. Dedicating time and effort is crucial in preparing against these attacks and minimizing their impacts. Here are a few measures that security and IT teams must follow to prevent such attacks:

Create an incident response plan so security teams know what to do if an attack occurs. This reduces the operational downtime and the likelihood of a breach or cyber-attack.
Backup critical business data in a secure location like the cloud environment as it recovers data during a ransomware attack.
Update the devices, applications, and systems to the latest version, as these fixes known vulnerabilities and security loopholes.
Invest in employee training and education as this keeps them updated about the latest threats surrounding financial institutions and know how to safeguard sensitive data.
Focus on cybersecurity best practices like encrypting devices, antivirus software, and firewalls to maintain network security.

Cybersecurity Guidelines and Frameworks

Non-profit organizations and governments worldwide should create cybersecurity guidelines and frameworks to mitigate ransomware attacks. Financial organizations must abide by laws like SOX and PCI DSS to control the impact of such notorious cyberattacks.

FS-ISAC (Financial Services Information Sharing and Analysis Center) is a non-profit, member-driven organization that helps financial institutions improve cyber resilience. Through its membership-based platform, FS-ISAC enables financial organizations to access threat information and cybersecurity guidance from experts. This allows them to remain informed about the latest trends and vulnerabilities within the cyber landscape. Besides sharing information with the members, FS-ISAC provides tools to mitigate and respond to cyber risks proactively.

Previously, the US Department of the Treasury's Office of Foreign Assets Control (OFAC) issued an advisory in September 2021. It highlighted the sanctions risks associated with ransomware payments and the steps organizations can take to mitigate them.

The Bankers Electronic Crimes Task Force (BECTF), State Bank Regulators, and the United States Secret Services have also developed a Ransomware Assessment Tool (R-SAT) for banks and nonbanks. This self-assessment tool has 16 questions to help financial institutions reduce the risks associated with ransomware attacks. The board of directors and people in executive management roles can better detect, respond, and protect from ransomware attacks.

Moreover, In November 2022, the European Union passed the Digital Operational Resilience Act (DORA) to strengthen the financial sector's resilience. This act applies to various financial institutions, including banks, cryptocurrency exchanges, investment firms, insurance companies, and trading platforms.

The DORA Act is composed of the following five pillars:

Cyber risk management
Cyber incident management
Digital operations resilience testing
Third-party risk
Information Sharing

The law will mark a significant shift in preventing cyberattacks and ensure quick recovery. However, the companies must wait as it will be effective from January 17, 2025.

Learn more on Cyber Security at Xpoit Academy.

Categories: : Defense Against Attacks