ECB stress test shows:

Banks insufficiently equipped against hacker attacks

A euro sculpture in front of the ECB headquarters in Frankfurt am Main

(Bild: APA/dpa)

According to the European Central Bank, banks in the eurozone need to make more preparations to cope with successful hacker attacks by criminals in the event of an emergency. A stress test shows "that banks have response and recovery mechanisms in place, but areas for improvement remain."

This was announced by the ECB on Friday. However, it did not provide any further details. The results of the stress test are to be incorporated into the annual bank review. The ECB has been responsible for monitoring the major banks in the eurozone since fall 2014.

"The importance of cyber resilience for the protection of our banking sector cannot be overstated," explained ECB Banking Supervisor Anneli Tuominen in a blog post on the stress test on Friday.

Disruptions in day-to-day business
According to the bank supervisors, the scenario envisaged that a successful hacker attack would lead to disruptions in the banks' day-to-day business. Among other things, the banks would then have to review their emergency measures to restore business processes.

The supervisors wanted to assess how the banks could cope with such an attack. How well equipped they are to prevent hacker attacks was not examined. 109 institutions took part in the stress test. 28 banks were examined in more detail.

Significant potential for damage
Cyber attacks and gaps in data security can cause considerable damage in the financial sector. In view of the increased geopolitical risks, banking supervisors have been pointing to an increasing number of hacker attacks in the financial sector for some time. In their view, there is a real race between an organized criminal industry and the defence against it.

Outdated IT infrastructure
One of the weak points is that the IT infrastructure at many institutions is not up to date, which makes them vulnerable to hacker attacks. The fact that banks have increasingly begun to outsource IT functions to third-party companies in recent years also increases the potential for attacks.

This includes, for example, the increasing use of cloud services, where data is no longer stored on in-house servers and internet applications are also provided by cloud service providers.