Enjoy complimentary access to top ideas and insights — selected by our editors.
What you need to know:
- Hackers were allegedly able to
bypass Coinbase’s defenses by bribing contractors or employees outside the U.S. - James Papa, an IT expert, is
suing Deutsche Bank and former employer Computacenter over alleged whistleblower violations. - The beach at the Office of the Comptroller of the Currency happened due to a
vulnerability in a high-level user account.
The evolution of banking technology has opened new doors for threat actors to steal customer data and hold it ransom for multimillion-dollar sums. But between the
For a start, many trade groups are working together to
Legislation like this has helped reduce hacking frequencies among banks, but new techniques make total defense a moving target.
In the fifth annual data threat report from the global information technology firm Thales, the company polled more than 3,100 professionals in security and IT management from across the globe on worldwide trends in data security, cloud adoption, compliance and security strategies.
Among areas of security tech investment, Information-as-a-Service cloud security took the top spot among 31% of respondents, 14% of whom rated it a top priority. Nine percent ranked it second-highest priority and 8% put it in third.
Companies are steadily gaining ground too. In 2021, 73% of enterprises that had failed a recent compliance audit had a history of one or more data breaches, while 41% of those that passed an audit had suffered a breach in the past. This year, those figures spread further apart at 78% and 21% respectively.
“We really started to see that trend last year, and it was something we highlighted in the previous report that it’s good to see continuing into this year,” Todd Moore, vice president of data security products at Thales, said. “Even though you pass a compliance audit, it doesn’t mean you’re not going to get breached, but there’s definitely a good chance that you’re putting the best practices in place to protect yourself from a security perspective.”
Read more:
While it might seem like cyberattacks are commonplace, security experts worry that financial institutions could become complacent and see them as just the cost of doing business.
“Because employees are constantly inundated with news covering major data breaches, they are beginning to think that they’re no big deal, when in reality, we have seen the real-world impacts on businesses’ bottom line,” said Max Vetter, vice president of cyber for the United Kingdom-based cybersecurity firm Immersive.
“Many organizations, including large enterprises and financial institutions, become so preoccupied with tracking emerging threats that they overlook the basic things like patching known vulnerabilities, securing credentials, enforcing multi-factor authentication and training staff to spot social engineering attempts,” Vetter said.
Hackers who catch the banking industry off guard are more often using
Eder Ribeiro, director of global incident response for credit bureau TransUnion, said threat actors are using AI in three ways: to create more convincing scams/online profiles for social-engineering attacks; to discover faster methods to exploit network vulnerabilities; and to combine “jailbroken” publicly available models with custom-made ones as the driving force behind spear-phishing attacks.
“Armed with new tools and more experience exploiting the human attack surface specifically, threat actors are scaling their criminal efforts to attack more victims with less effort,” Ribiero said.
Read more:
Banks are starting to double down on improving cybersecurity defenses in the wake of these breaches, whether it’s Capital One’s efforts to
“The barrier to entry has dropped, and a single actor with the right tools can now launch sophisticated campaigns that once required an entire team,” said Dr. Darren Williams, founder and CEO of global cybersecurity firm BlackFog.
Below are noteworthy cybersecurity breaches that hit the banking industry in recent months, and expert insights into how others can better protect themselves.
Coinbase breach is a stark reminder of cybersecurity importance
Cybersecurity threats are evolving in lockstep with the growth of new technologies and techniques, keeping hackers one step ahead of their victims. The recent incident at crypto exchange Coinbase is the latest example of how hacking attempts come in all shapes and sizes.
Unnamed threat actors breached Coinbase’s defenses by allegedly bribing contractors or employees outside the U.S. who occupy support roles within the company to access information about customer accounts, as well as internal documentation covering customer-service and account-management systems.
Current estimates for how much the hack will cost Coinbase, which include reimbursement for customers that fell victim to threat actors and remediation costs, range from $180 million to $400 million, according to the company’s May 15
“The Company plans to aggressively pursue all remedies. … As the Company’s investigation is ongoing, the full impact of these events are not yet known,” the filing said.
Read more:
Aspire USA’s hack impacts more than 161,000 customers
Aspire USA, a software provider for money service businesses,
Valsoft and AllTrust, the parent companies of Aspire USA, reported that the incident was discovered on Feb. 14 of last year and determined that an unnamed user was able to successfully transfer data outside of the organization between Feb. 12 and Feb. 15. Despite working with outside cybersecurity experts, Aspire USA couldn’t determine which files were affected or publicly state the vulnerability leading to the incident.
“The information that could have been subject to unauthorized access includes name, Social
Security number, driver’s license number and financial account information,” according to a notice sent to impacted individuals in Maine and the state’s attorney general.
Read more:
Fired Deutsche Bank whistleblower sues, alleging retaliation
James Papa, an IT expert, filed a lawsuit against his former employer Computacenter and Deutsche Bank over allegations of retaliation following problematic behavior from a coworker.
The lawsuit claims that while Papa was employed by the IT firm on contract for Deutsche Bank, he flagged behavior from a coworker in 2023 wherein the named employee was bringing his girlfriend, known only as Jenny, into the bank’s tech rooms containing computer servers with confidential information.
Further claims in the suit allege that Jenny is a “Chinese citizen with significant computer expertise” who left the country after a second set of incidents later that year along with the employee who granted her access.
Papa’s complaint hinges on purported violations of New York State’s Whistleblower Protection Law and alleges a conspiracy to cover up security failures. He is also suing Marc Senatore, a vice president at the bank who was his direct supervisor.
Read more:
OCC suffers major cybersecurity breach
On April 8, the Office of the Comptroller of the Currency reported that highly sensitive information from a bank regulated by the agency was exposed through a data breach.
The Feb. 11 hack occurred due to a vulnerability in a high-level user account with administrative privileges over the OCC’s email system and was caught when unusual user activity between a system administrator and staff mailboxes was detected by the OCC’s internal processes.
“I have taken immediate steps to determine the full extent of the breach and to remedy the long-held organizational and structural deficiencies that contributed to this incident,” said Rodney Hood, acting chairman of the OCC. “There will be full accountability for the vulnerabilities identified and any missed internal findings that led to the unauthorized access.”
Read more:
Western Alliance Bank’s data breach hits 22,000 victims
Western Alliance Bank in Phoenix, Arizona, reported that from Oct. 12 to Oct. 24 of last year, the personal information of more than 22,000 consumers was exposed through a third-party vulnerability.
The bank discovered the incident earlier this year, relaying to the Maine attorney general that information involved in the breach included names, Social Security numbers, dates of birth, financial account numbers, driver’s licenses, tax identification numbers and passports. The vulnerability was located in the vendor’s secure file transfer software.
“There has been no material impact to business operations or the company’s financials, and we are reviewing existing policies and implementing additional safeguards to further secure the information in our systems,” the bank said in a statement.
Read more: