Cyber threats to online banking services cost banks nearly $1.8m

The crippling implications of online banking security incidents have be brought to light by the latest Kaspersky Lab report into cybersecurity threats in the financial sector. The report shows that an accident involving a bank’s online banking services cost the organisation $1,754,000 on average — that’s double the price of recovering from a malware incident, which costs as much as $825,000 on average to resolve.

The study shows that 61 per cent of cybersecurity incidents affecting online banking come with additional costs for the institution targeted — including data loss, the loss of brand/company reputation, confidential information becoming leaked and more. These findings, and others in the report, are urging financial institutions to consider the cost implications of cybersecurity threats and put appropriate measures in place to protect themselves and their customers from incidents involving online banking — particularly from DDoS attacks, which can threaten online banking services.

 DDoS attacks against financial institutions are often designed to cripple banking websites. The report shows that when organisations are attacked by DDoS, customer-facing resources suffer more in banking than in any other sector. For example, 49 per cent of banks that have suffered a DDoS attack have had their public website affected (compared to 41 per cent of non-financial institutions) and 48 per cent have had their online banking affected when they’ve been targeted by DDoS.

Banks worry about attacks against their online banking services more than about other threats. However, according to the report, DDoS only ranks third, being superseded by concerns about malware and targeted attacks, despite the fact that DDoS is more costly to recover from than malware.

Recovering from DDoS is also more expensive for banks than non-financial organisations. The report shows that a DDoS incident can cost a financial institutions $1,172,000 to recover from, compared to $952,000 for businesses in other sectors.

With the most feared consequence of a cyber incident being the lost of brand/company reputation for almost one-in-five (17 per cent) financial institutions, Kaspersky Lab is urging businesses in the sector to be more aware of the dangers they face, to protect their services, customers and brands from harm.

Kirill Ilganaev, Head of Kaspersky DDoS Protection, Kaspersky Lab says, “In the banking sector reputation is everything, and security goes hand-in-hand with this. If a bank’s online services come under attack, it is very difficult for customers to trust that bank with their money, so it’s easy to see why an attack could be so crippling. If banks are to protect themselves effectively from the price tag of an online banking cybersecurity incident, they first need to become more prepared for the dangers DDoS attacks pose to their online banking services. This threat should be featuring higher on banks’ security priorities,”

To be better prepared for dealing with the threat of an attack on their online banking services, Kaspersky Lab is encouraging financial institutions to share security intelligence.