Financial Services Firms Take the Biggest Hit in Cyberattacks in 2016

In 2016, financial services firms saw an uptick in numbers that had been on the decline in 2015. According to the recently released “Security Trends in the Financial Services Sector” report, cyberthieves are shifting their focus from the healthcare and retail industries back to the financial services companies. Why? Presumably because that’s where the money can be found. Attacks against them occurred 65% more often than toward others. What is also disturbing is the 937% year-over-year increase in the amount of records breached. In 2016, it was a whopping 200 million.

Let’s start with a definition. IBM defines an attack as “malicious activity that is attempting to collect, disrupt, deny, degrade or destroy information system resources of the information itself.” The favorite attack vectors, according to the report were DDOS attacks, business email compromise (BEC), and ransomware with the favorite malware being Dyre, Dridex, GozNym, and TrickBot, which is expected to surpass Dridex in 2017 as the tool of choice for increasing the amount of spam and attempting to infect more devices.

“What these numbers are showing is that traditional security methods, like firewalls, IDS, and antivirus/antimalware solutions are no longer sufficient protection. Financial institutions also need provide ongoing security training and awareness for employees,” says Jim Stickley, CEO of Stickley on Security.

The report corroborates Stickley’s comments. The researchers wrote that training programs need to be developed to “foster awareness regarding BEC scams and other phishing scams through education.” It also suggests that testing staff and encouraging them to report suspicious emails for further investigation is a worthwhile effort.

Fifty-eight percent (58%) of the attacks last year were due to “insider” events and 95% of those were due to employee mistakes such as falling for a phishing scam.

There is a silver lining to all of this doom and gloom news. The number of incidents (defined as events requiring more investigation) was down to 94 last year from 192 in 2015.