Dutch regulator warns financial sector is increasingly vulnerable to cyberattacks
The increasing number of cyberattacks poses a continuous challenge to the operational and financial resilience of financial institutions. Yet, awareness regarding cyber resilience is lagging.
The Dutch Authority for the Financial Markets (AFM), the supervisor for the financial market sector in the Netherlands, is warning that financial institutions possess large amounts of sensitive data and can therefore be an attractive target for hackers.
“The question is not whether the financial markets will be hit by a cyberattack, but when and how. Like the rest of the industry, we are concerned about this,” AFM Chairman Laura van Geest says in response to a recent report discussing the current state of affairs in the global economy and international financial markets.
Even with all the measures that financial institutions are taking, they can’t prepare for this reality on their own, she argues. Preventing cybersecurity incidents and addressing and resolving unexpected situations require a “collective effort” from financial institutions, governments, regulators, businesses, and consumers.
A survey shows that financial institutions, on average, rate their cyber risks as low or medium, even though the number of cybersecurity incidents increases and their impact grows.
This demonstrates a lack of awareness regarding cyber threats and, as a result, a failure to implement sufficient and proportionate security measures to mitigate these risks, the financial supervisor claims.
The Dutch financial regulator also points to the impact of artificial intelligence (AI): it allows vulnerabilities to be discovered and exploited more quickly. On the other hand, AI technology can also help financial institutions detect and respond to cyber threats more rapidly.
“Digitization brings efficiency, speed, and scalability, but also carries an inherent vulnerability if IT isn’t properly managed. The rise in the number of cyberattacks gives asset managers a compelling reason to thoroughly examine whether certain basic cybersecurity measures have been adequately implemented and enforced,” the AFM recommends.
Earlier this month, Crédit Mutuel Arkéa was hit by a cyberattack, allowing the attackers to carry out fraudulent financial transactions.
“This incident has had no impact on (customer) assets and has only caused a delay in the execution of certain transfers,” the French bank said in a statement at the time, adding that the attack had been contained and that relevant authorities were informed immediately.