The Financial Conduct Authority (FCA) received 819 cyber incident reports from financial services last year, 69 more cases than the previous year, according to reports obtained after a freedom-of-information request submitted by consulting firm RSM 

Reasons to be uncheerful

Retail banks topped the list, reporting 486 cases, wholesale financial markets placed 115 reports, and retail investment firms rounded out the list with 53 incidents. Third-party failure, hardware and software issues, and change management were the top three reasons for cyber issues. Cyberattacks were the fourth common cause of incidents, with firms reporting 93 attacks in 2018. More than half of the cyberattacks reported were phishing attacks, and 20 percent were ransomware attacks. Phishing and ransomware attacks are the most reported types of cyberattacks on financial services firms, but in most cases the causes of outages were far more mundane. Third-party failure, accounting for 21 percent of reports, along with the next two common causes of hardware and software issues and change management do not hit the headlines. Hence, it may surprise that cyberattacks are only the fourth most common cause of a problem.

Cyberattacks

Of the 93 reported cyberattacks over half were phishing attacks (about the same amount number as caused by human error) while 20 percent were ransomware attacks. RSM said that while the jump in cyber incidents looks alarming, it's likely this is due in part to firms being more proactive in reporting incidents to the regulator, plus the increased focus on security and data-breach reporting following the arrival of GDPR. The FCA has previously stated that under-reporting of incidents remains a problem, with Megan Butler, executive director of supervision for investment - wholesale and specialists stating “We are worried that a lot of firms seem overly confident about their ability to manage flagship IT change programmes and keep their systems up to date.”