Cyberattacks hit over 20 million people last year as financial services companies remain attractive targets
Santander has confirmed that around 30 million of its customers have had their bank data stolen by hackers.
“Following an investigation, we have now confirmed that certain information relating to customers of Santander Chile, Spain and Uruguay, as well as all current and some former Santander employees of the group had been accessed,” the high street bank said in a statement.
It added that “customer data in all other Santander markets and businesses are not affected.”
Santander apologised and assured that it is proactively contacting affected customers and employees directly and has also notified regulators and law enforcement and is cooperating with them.
All Santander staff and '30 million' customers hacked https://t.co/vKunwdzAUf
— BBC News (UK) (@BBCNews) May 31, 2024
Figures from the Information Commissioner’s Office (ICO) revealed that data belonging to as many as 20.4 million people was compromised in cyberattacks on financial services companies in the past year.
The number marked a 143% increase from 8.4 million individuals affected the previous year, with breaches including attacks on banks and pension funds. In the year to June 2023, there were 640 cybersecurity breaches at UK financial services firms, with 246 of these incidents occurring in the pensions sector alone.
Despite robust defences, financial services companies remain attractive targets due to the valuable personal data they hold, according to specialty insurance and reinsurance group Chaucer.
Ben Marsh, class underwriter at Chaucer, explained that the primary aim of cyberattacks on pension funds or banks is rarely the theft of assets. Instead, attackers often seek to steal personal data to resell or use in extortion schemes.
In the case of Santander, the BBC reported that hackers are attempting to sell confidential information belonging to millions of Santander staff and customers. The hack was reportedly conducted by the same gang that claimed to have hacked Ticketmaster recently, stealing details of around 560 million customers.
“Financial services businesses will often hold huge amounts of data they collect as part of their client onboarding process such as debit and credit card numbers, passports, address information, and other ID documents,” Marsh said. “This data is highly valuable and is regularly traded on the dark web.
“Financial services firms are also thought to be more susceptible to the blackmail element of ransomware attacks. If a financial services firm loses its reputation for data security, then it could rapidly lose clients and could impact shareholder trust.”
Hackers have also targeted third-party organisations that financial services providers outsource work to. The Pensions Regulator’s cybersecurity guidance stipulates that trustees are responsible for the security of a pension scheme’s assets and data, even when outsourced to third parties.
Companies that fall victim to cyberattacks often face substantial losses and increasingly rely on insurance to cover the costs. These costs can include hiring external IT and data security consultants, legal advice, compensation, loss of revenue due to business interruption, and ransomware payments. The extent of coverage depends on the specifics of the cyberbreach insurance policy.
Marsh emphasised the importance of continuous investment in cybersecurity, noting that cybercriminals are evolving their tactics and leveraging emerging technologies such as AI.
“Companies are realising more and more that investment in cybersecurity is a continuous cycle of improved protection and protocols to defend against cyberattacks,” he said.
Want to be regularly updated with mortgage news and features? Get exclusive interviews, breaking news, and industry events in your inbox – subscribe to our FREE daily newsletter. You can also follow us on Facebook, X (formerly Twitter), and LinkedIn.
