Financial Services · Security & Resilience
Articles in this selection, newest first. Change the filters, or clear them to see every article.
17 articles · Financial Services · Security & Resilience
Articles
Week of 31 August 2026
Bank cyber gaps now arrive as observations the board never has to see
Two bank regulators narrowed formal findings to problems that threaten material financial harm, a year after a shared cyber checklist was retired. Many cyber weaknesses will now arrive as informal observations, so banks must decide for themselves what reaches the board.
Week of 18 May 2026
Searching by balance: how bribed bank insiders choose their targets
Bank insider cases prosecuted in 2026 show bribed employees selling three things: the search that finds wealthy customers, the screens that expose them, and the overrides that open doors. A bank can control all three without first catching the insider.
Week of 6 April 2026
When AI made flaws cheap to find, banks’ patch queues set the pace
An AI model that could find serious software flaws prompted a meeting with bank chief executives, yet most banks could not use it. Their test was how fast they could install the fixes that would follow.
Week of 2 March 2026
Iran’s war tested banks’ decision rights more than their defenses
After the strikes on Iran, the cyber warnings named old tricks banks already knew how to stop. The harder test was judgment under pressure: what to fix first, who could override a change freeze, and what to ask of the providers banks depend on.
Week of 16 June 2025
Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
A hacking group known for working through one industry at a time reached U.S. insurers in June 2025, and a warning became a deadline. Financial firms needed a pre-agreed surge mode: a clear trigger, tighter help-desk rules and containment planned around stolen identities.
Week of 7 April 2025
Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess
The OCC’s email breach showed that a bank’s most candid account of its own weaknesses sits with a regulator it can neither audit nor replace. Banks still control what they write, how it travels and how they respond when the holder is breached.
Week of 17 February 2025
Bybit’s signers approved what their screens showed, which was not what they signed
The largest crypto theft on record beat a multi-person approval process without breaking it: attackers simply changed what the approvers saw on screen. Any bank approving payments through software carries the same risk at four points, from how the screen is built to recovery.
Week of 14 October 2024
NYDFS wrote no AI rule, and made AI risk part of what the CEO certifies
New York’s October 2024 letter on AI and cybersecurity added no new rules. Because the CEO and security chief already sign a yearly compliance certification, though, it turned four AI risks into evidence those executives must be able to show.
Week of 12 February 2024
Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure
A video call full of familiar, fake faces persuaded one employee to send about US$25 million. The fraud beat a meeting, not a payment system. Banks need controls at the invitation, inside the meeting and at the handoff to money.
Week of 6 November 2023
Three seats at ICBC’s ransomware attack, and the plan each one needed
Ransomware hit ICBC’s U.S. broker-dealer in November 2023, and Treasury trades still had to settle that day. Every firm in the market could have been sitting in any of three seats, and each seat needed its own plan, written well before the crisis.
Week of 11 September 2023
For banks, the MGM and Caesars intrusions were about the few accounts that run the identity platform
The September 2023 casino attacks began with phone calls to help desks and ended with control of identity systems. What mattered for banks was a handful of powerful accounts: how they are recovered, who may recover them, and how a takeover would be spotted.
Week of 30 January 2023
ION’s outage exposed a vendor no board had on its critical list
Ransomware at ION’s cleared derivatives unit took the same back-office tool away from firms across the market on the same day. The risk sat with a specialist vendor few boards had heard of, and every firm has some.
Week of 4 July 2022
Rogers: the bank outage that started at someone else’s carrier
One Canadian carrier went dark for most of a day, and debit cards stopped working nationwide, even at banks that had never bought a Rogers line. Telecom dependency hides in places a two-carrier policy cannot reach.
Week of 18 April 2022
TraderTraitor aimed fake job offers at the engineers who hold the keys
In April 2022, a federal advisory described North Korean operators courting crypto-firm engineers with fake job offers and booby-trapped apps. For financial firms, a recruiter’s message reaches the people with the most access through a channel security rarely watches, so assume one will succeed.
Week of 15 March 2021
Why business email compromise belongs to the payments team
The FBI’s 2020 crime report again ranked business email compromise as the costliest kind of online fraud. For banks and credit unions, the controls that decide those losses sit at three points in payment operations, and the inbox is only the first.
Week of 11 January 2021
Before the 36-hour clock: deciding which bank incidents count
On paper, the banking agencies’ proposed incident notification rule was a simple deadline. The harder work came before the clock started: a named person deciding what counts as a material disruption, and vendor warnings that reach that person in time.
Week of 10 February 2020
What the Equifax indictment changed for banks, and what it did not
In 2020, the US charged four Chinese military officers over the Equifax breach. Knowing who did it settled an old question. For banks, it changed little that matters day to day: the data stays exposed, the door was ordinary, and the blame stays home.