Financial Services Cyber Statistics Guide: Attacks, Costs and Credential Risk

Financial services is one of the most attacked sectors in every major dataset, but the figures come from very different vantage points, from confirmed breach analysis to supervisor surveys to bot traffic counts, and they answer different questions. This page gathers the most useful recent cyber statistics for banks, insurers, payment firms and other financial institutions, each with its publisher, report and period. Primary sources are the Verizon 2026 Data Breach Investigations Report (DBIR) finance section, the ENISA Threat Landscape: Finance Sector, the International Monetary Fund (IMF) Global Financial Stability Report analysis of cyber risk, the Bank of England Systemic Risk Survey, Financial Conduct Authority (FCA) incident data and the Imperva Bad Bot Report. It is for CISOs, operational resilience leads, risk committees and supervisors' counterparts in firms who need defensible numbers for board reporting, scenario design and regulatory submissions. The regulation itself is covered in the Financial Services Cyber Regulation Map. Last reviewed: November 2026.

Key takeaways

• Finance attracts a large share of attacks. The IMF found attacks on financial firms account for nearly one-fifth of the total cyber incidents it analysed, and that extreme losses have more than quadrupled since 2017 to $2.5 billion.
• Attackers want money. Verizon's 2026 DBIR records 3,809 incidents and 1,300 confirmed breaches in Finance and Insurance, with external actors in 88% of breaches and a financial motive in 98%.
• Cyber attack is a top systemic risk. In the Bank of England Systemic Risk Survey for 2026 H2, 75% of respondents cited cyberattack as a key risk to the UK financial system, ranking it second.
• Banks take most of the hits in Europe. ENISA found credit institutions affected in 46% of 488 publicly reported finance sector incidents between January 2023 and June 2024, and 58% of DDoS attacks on the sector targeted them.
• Bots go where the money is. Imperva found financial services accounted for 24% of all bot attacks and 46% of account takeover incidents in 2025.

How to read financial services cyber statistics

• Public versus confidential data: ENISA counts publicly reported incidents only. Incidents reported confidentially to supervisors under DORA or NIS2 are not in its dataset, so its counts are a floor.
• Sample size per sector: DBIR sector figures depend on contributor mix. Use the patterns and proportions rather than treating 1,300 breaches as the sector total.
• Perception versus incidence: the Bank of England survey measures what firms worry about, not what happened. It is strong evidence for board attention, weak evidence for frequency.

Breach patterns, actors and data

• System Intrusion leads: Verizon says System Intrusion, largely ransomware-driven, has been the top pattern in finance since 2022, having competed with Social Engineering in the 2022 and 2023 reports.
• Insiders fell as a share: internal actors dropped from 22% to 12% of finance breaches. Insider risk has not disappeared: the Coinbase Insider Breach 2025 shows bribed support staff exposing customer data.
• Credentials are a quarter of what is taken: credentials appear in 26% of finance breaches. Stolen credentials, human and machine, are reused for later intrusions and fraud.

Threats to European financial entities

• Hacktivism shapes the public picture: ideological actors drive more than half of publicly reported incidents, mostly DDoS against banks and public finance websites. That explains why operational disruption dominates the consequence figures.
• Customers are targets too: individuals were affected in 38% of social engineering incidents and 40% of fraud incidents in ENISA's data, against 36% and 35% for credit institutions. Fraud against customers is a bank's problem whoever is the victim.
• Ransomware hits the supply side: ENISA saw fewer ransomware attacks in finance than in other sectors, with service providers the most common target. Third-party oversight under DORA addresses exactly this. See the DORA ICT Third-Party Risk and Register of Information Guide.

Systemic risk and supervisory view

• Third parties lead UK disruption: the FCA says the leading root cause of operational disruption is problems with the third parties firms use, without giving a percentage. It also cautions that more reported incidents do not mean the sector is less resilient.
• Board attention is high: the UK Cyber Security Breaches Survey 2025/2026 found 54% of finance and insurance businesses had board members responsible for cyber security, the highest of any sector, against 31% overall, and 89% said cyber security was a high priority for senior management.
• Systemic concern drives regulation: the IMF finding that only about half of countries had a financial sector cyber strategy or regulation explains the wave of rules since, from DORA to national supervisory standards.

Fraud, bots and account takeover

• Account takeover is concentrated in finance: nearly half of the account takeover incidents Imperva saw in 2025 hit financial services, because a taken-over account converts directly to money.
• APIs are the front door: open banking, mobile apps and partner integrations expose APIs that bots target. The Open Banking and Open Finance Security Guide covers the controls.
• Volumes are covered elsewhere: payment fraud and scam figures are in the Online Fraud and Scam Statistics Guide and the Business Email Compromise and Fraud Statistics Guide.

Choosing the right figure for the audience

Boards, supervisors and engineering teams ask different questions. Matching the figure to the question avoids quoting a perception survey as if it were incident data.

• Use proportions, not raw counts: the DBIR's 1,300 finance breaches and ENISA's 488 incidents reflect what those publishers could see. Shares and rankings travel better between contexts than totals.
• Pair external with internal evidence: a supervisor or board will accept an external benchmark as context, but expects your own incident, recovery and supplier data to show where the firm actually stands.
• Watch reporting regimes change the numbers: new incident reporting rules such as DORA major ICT incident reporting will raise counts of reported incidents without any change in attacker behaviour. See the DORA Major ICT Incident Reporting Guide.

Where identity fits

Finance runs on identities: customer logins, employee access, privileged administrators and a growing estate of machine identities in payment rails, cloud platforms and API integrations. The figures above show credentials taken in a quarter of DBIR finance breaches and finance leading account takeover. Machine credentials matter as much as human ones: the Capital One Breach 2019 turned on cloud role credentials, and the Bybit Hack 2025 on one developer's AWS session tokens. Inventory, least privilege and rotation for these non-human identities belong in the same resilience programme as customer authentication. See the Banking Cybersecurity Programme Guide.

What the numbers mean for defenders

Internal measures that turn these benchmarks into evidence for a board or supervisor:

1. Account takeover rate per 10,000 active customer accounts, by channel.
2. Time to recover important business services in tests, against stated impact tolerances.
3. Share of critical ICT suppliers with current risk assessments and exit plans.
4. Mean time to patch internet-facing systems listed in the CISA Known Exploited Vulnerabilities catalogue.
5. Machine identity coverage: share of service accounts, API keys and cloud roles with a named owner and rotation date.

Common mistakes when using financial services statistics

• Treating ENISA counts as totals: they cover publicly reported incidents only. Confidential supervisory reports are not included.
• Reading survey concern as incidence: 75% of Bank of England respondents citing cyber risk says nothing about how many attacks succeeded.
• Mixing denominators: share of bot attacks, share of incidents and share of breaches cannot be compared or combined.
• Using the wrong edition: the DBIR finance internal-actor share fell from 22% to 12% in a year. Name the edition you quote.
• Ignoring sub-sectors: banks, insurers, payment firms and crypto-asset providers face different mixes. ENISA's entity splits are more useful than a single "finance" figure.

Practitioner checklist

• Cite every figure with publisher, edition, period and what was counted.
• Use DBIR finance patterns to prioritise scenarios for resilience testing.
• Compare your account takeover and bot rates with Imperva's sector figures, labelled as single-vendor data.
• Map critical third parties and test exit plans, given the FCA root cause finding.
• Include DDoS by hacktivists and ransomware at a service provider in tabletop exercises.
• Bring machine identities into scope for inventory, ownership and rotation.
• Report a small set of recurring internal metrics alongside external benchmarks to the board.
• Refresh figures each time the DBIR, ENISA and Bank of England publish new editions.

Standards and references

• Verizon: 2026 Data Breach Investigations Report
• ENISA: Threat Landscape, Finance Sector
• IMF: Rising Cyber Threats Pose Serious Concerns for Financial Stability
• Bank of England: Systemic Risk Survey Results 2026 H2
• FCA: Outcomes metrics, minimising the impact of operational disruptions
• UK Department for Science, Innovation and Technology: Cyber Security Breaches Survey 2025/2026
• Imperva: Bad Bot Report 2026
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Financial Services Cyber Regulation Map · Threat Actors Targeting Financial Services Guide · Top 10 Financial Services Cyber Threats · DORA Guide · Data Breach Statistics Guide