Compromising Bank Customer Trust: The Price of Inadequate Data Protection

Banks hold not just money, but also emotions and aspirations. Countless stories unfold within bank walls, reflecting the intimate connection between money and emotion. Beyond the numbers and transactions, every dollar represents individuals’ hopes, dreams, and livelihoods. As the trusted custodian of our financial well-being, our banks hold not just our money but also the aspirations tied to it.

However, in every bank’s shadow is the looming threat of costly cyberattacks. Cybercriminals, armed with sophisticated tactics and techniques, target gaps in banks’ critical business infrastructure and database management systems to gain access to sensitive financial and personal information. The consequences of successful attacks strike at the very heart of banks — customer trust — escalating financial losses due to customer defection. Banks are undergoing more scrutiny internally and externally to validate that their current cybersecurity measures are effective in the evolving threat landscape. 

The escalating threat landscape: Banks in the crosshairs

Financial institutions have an ethical, regulatory, and financial duty to safeguard customer personal data against the rising tide of cyber threats. That’s getting more difficult.

In 2023, the financial industry ranked as the second most costly for cyberattacks with the average global cost per data breach at $5.9 million.   If attackers are successful, they may gain access to millions of transaction and client records — the average cost for breaches of 50 million records or more now tops $300 million.  

Not only are banks highly targeted by cybercriminal attacks, but these attacks are more costly and increasingly successful. To prevent significant financial losses, boards, and the C-suite need to have a thorough understanding of the cyber risks their organizations face. They must also demonstrate that they are making effective decisions to ensure that cybersecurity risks are within acceptable levels.

What threats are increasing in volume and severity?

Sharing sensitive data across multiple services while complying with global data privacy regulations is crucial in today’s multicloud environments. 

• Recent data shows that over 50% of all traffic to financial services websites comes from bots, automated programs designed to execute tasks and perform malicious activities. This extensive bot traffic poses significant challenges to a bank’s security infrastructure, making it increasingly difficult to differentiate between genuine customer interactions and potential threats.
• Malware stands out as the fastest-growing threat of 2024, with 41% of enterprises witnessing a malware attack in the past year – closely followed by phishing and ransomware.4 Cloud assets, including SaaS applications, cloud-based storage, and cloud infrastructure management, remain the primary targets for such attacks.
• The data compromised within financial institutions included Personal (74%), Credentials (38%), other (30%), and Bank (21%) information (breaches). 5

Are new exploits and major disruptions looming?
In 2023, the financial sector faced a significant disruption due to cyber attackers exploiting commonly used file-transfer tools. Hackers targeted financial institutions that were not adequately equipped to handle such attacks, which resulted in the stealing of highly sensitive data and the interruption of online services. The unauthorized access to customer accounts undermines the financial system and erodes customers’ trust in their banks.

As cyber threats continue to evolve and grow more sophisticated, it is increasingly crucial for IT and security teams to thwart unauthorized access to high-value assets. What’s more, generative Artificial Intelligence (AI) has made it easier for cybercriminals to exploit financial systems weaknesses and launch attacks at a higher velocity. Therefore, banks must take all necessary precautions to safeguard their systems and protect themselves from potentially devastating cyberattacks.

Fortifying data protection: A prerequisite for trust

Ramping up to defend your data estate requires assessing your current cybersecurity strategy and prioritizing data security to reduce risk in this evolving landscape.

1. Take a data-centric approach: Prioritize securing the data first. Use a framework to identify data, data owners, access controls, and security policies, and integrate them with a strong threat management and remediation program. 
2. Highlight the inherent value of data security: Advocate for the protection of sensitive information to not only safeguard customers but also enhance your institution’s reputation. 
3. Simplify security practices: Consolidate security tools and unify business logic across all data stores (on-premises and cloud) to achieve efficiency, security, and agility.
4. Automate protection of sensitive data from your edge to your data center to your cloud: Be aware of the location of all your data and its security. Use a security platform that offers predictive and contextual intelligence, and robust automation for detecting and preventing breaches.
5. Navigate complex and stringent regulatory requirements: Effectively manage compliance with applicable laws, regulations, policies, standards, and other rules to avoid non-compliance, lengthy audits, penalties, and fines.

Taking action

To defend against cyberattacks and maintain customer trust, banks should implement a proactive data protection strategy and address core vulnerabilities. Strong data protection demonstrates the bank’s commitment to safeguarding customers’ financial well-being and reinforces its reputation as a reliable and trustworthy financial partner. Banks need to clearly understand the assets they are protecting, laying the groundwork for long-term success.

Our next blog will dive deeper into the gap between compliance requirements and comprehensive data security within financial institutions.

Learn more about adopting proactive data protection strategies within your financial institution.

_____________________

1 https://www.ibm.com/reports/data-breach

2 https://www.ibm.com/reports/data-breach

3 https://www.imperva.com/blog/why-attackers-target-the-financial-services-industry/

4 https://cpl.thalesgroup.com/data-threat-report

5 https://www.verizon.com/business/resources/reports/2023-dbir-finance-snapshot.pdf