Nine out of 10 banks suffered a cyber-attack last year, OAS confirms

The cybercrime wave that has swept across Latin America over the last couple of years has been laid bare by a new report from the Organization of American States (OAS).

High-profile cases this year have included banks in Mexico and Chile, with North Korea being tipped as the source.

However, these represent only the tip of the iceberg, according to OAS, which confirmed that nine out of 10 banks in Latin America and the Caribbean suffered a cyber-attack last year.

Worryingly, 37% of these financial institutions said they had fallen victim to at least one successful attack.

The report, based on data from 191 banks across the region, was presented this week at the OAS Cybersecurity Symposium in Washington, DC.

“The financial sector, and banking in particular, has been one of the sectors with the highest digitisation rates,” said Luis Almagro, the OAS general secretary, in his introduction to the report.

“Every day a greater number of clients of the financial sector are users of electronic banking, they carry out transactions by internet or payments through mobile devices.”

“This adaptation of business models and the exploitation of digital channels aim to make the most of the advantages of technologies – the flip side of which is the appearance of new risks that must be prevented in order to mitigate possible attacks.”

The most frequent events were malicious code or malware, reported by 80% of banks, followed by violation of clear desk policies (63%), and targeted phishing (57%).

Also highlighted in the report were daily malware and phishing events aimed at accessing bank systems, identified by 24% and 22% of banks respectively.

However, nearly four in 10 of these incidents weren’t reported, although in the case of the largest banking entities this number falls to 19%.

The OAS researchers found a mixed picture in terms of the measures banks have in place to detect and analyse security events.

More than 90% said they have implemented both firewalls and automated virus and system updates, and 85% carried out intrusion detection and prevention systems, along with processes for monitoring threats and vulnerabilities.

However, almost half still aren't adopting tools, controls, or processes that use emerging digital technologies such as big data, machine learning, or artificial intelligence, the researchers said.

Payment systems such as SWIFT or Mexico’s SPEI seem to be the next trend in cybercriminal activity in the region, according to the report.

Indeed, last year security firm Group-IB found indications that cybercriminals, including Russia’s MoneyTaker group, were gathering intelligence on cross-border payment systems used by banks in Latin America, as well as North America, presumably in order to launch future attacks against Latin American or Caribbean banks.

“While no system is totally secure, there are ways in which institutions can best protect themselves from the complex methods deployed against them – including securing their local environment, managing security risk in interactions with counterparties, sharing relevant information, and acting in a timely manner on the security risk information they receive,” advises Juan Martinez, managing director of SWIFT in Latin America and the Caribbean, who contributed to the report.

“The adversaries are prepared to invest a large amount of time planning and preparing their attacks. Knowledge, determination, and collaboration are essential ingredients to achieve cyber security resilience.”