British banks keep cyber attacks under wraps to protect image
By Lawrence White
LONDON (Reuters) - Britain's banks are not reporting the full extent of cyber attacks to regulators for fear of punishment or bad publicity, bank executives and providers of security systems say.
Reported attacks on financial institutions in Britain have risen from just 5 in 2014 to 75 so far this year, data from Britain's Financial Conduct Authority (FCA) show.
However, bankers and experts in cyber-security say many more attacks are taking place. In fact, banks are under almost constant attack, Shlomo Touboul, Chief Executive of Israeli-based cyber security firm Illusive Networks said.
Touboul cites the example of one large global financial institution he works with which experiences more than two billion such "events" a month, ranging from an employee receiving a malicious email to user or system-generated alerts of attacks or glitches.
Machine defenses filter those down to 200,000, before a human team cuts that to 200 "real" events a month, he added.
Banks are not obliged to reveal every such instance as cyber attacks fall under the FCA's provision for companies to report any event that could have a material impact, unlike in the U.S. where forced disclosure makes reporting more consistent.
"There is a gray area...Banks are in general fulfilling their legal obligations but there is also a moral requirement to warn customers of potential losses and to share information with the industry,” Ryan Rubin, UK Managing Director, Security & Privacy at consultant Protiviti, said.