Firms Look to Mitigate Consequences From Data Breaches

The interconnected nature of financial systems can have cascading consequences when data is compromised.

And with the recent news that the June cyber breach at Evolve Bank & Trust has reportedly impacted upwards of 7.6 million customers, containing the impact of a single data breach before it can ripple throughout an entire ecosystem is top of mind for banks, FinTechs and businesses alike.

After all, it was just Monday (July 8) that hackers were able to gain unauthorized access to dozens of HubSpot accounts. Despite the smaller scale of the breach, considering that many people reuse passwords across accounts, a single, targeted breach on a defined customer subset can trigger extensive and far-reaching consequences.

That’s because, when a data breach occurs, sensitive information such as account numbers, personal identification numbers (PINs), usernames and passwords are exposed. In FinTech and banking, this often includes financial data, transaction histories and personal identification details.

The average consumer has multiple financial accounts, and many FinTech platforms link to traditional bank accounts, credit cards and other financial services. A breach in one system can provide access to others, allowing fraudsters to exploit multiple services, and can have a profound butterfly effect as scammers leverage the illicitly obtained information to probe vulnerabilities across the entire financial value chain.

Read more: Dissecting the Criminal Mind: Why They Target Company Data

Attacks Can Lead to Ripple Effects Throughout Ecosystems

Data extortion and ransomware attacks have had a substantial impact on businesses and marketplaces during the first half of 2024, PYMNTS reported July 4.

In just one example of how a single, strategically activated adversarial breach can have a far-flung effect, the criminals who stole a “significant volume of data” from cloud database accounts hosted by Snowflake have since turned around and used that information to breach security perimeter of other companies that include LendingTree subsidiary QuoteWizard, Advance Auto Parts,  Ticketmaster, Santander Bank, the City of Cleveland and more.

Making matters worse, the cybercriminals behind the Snowflake breach have publicly claimed to be selling stolen data — meaning the Snowflake hack may snowball even further.

American cybersecurity firm and Google subsidiary Mandiant is investigating the Snowflake attack and reported that the threat campaign has resulted in “numerous successful compromises.”

Criminals can use breached data to create synthetic identities, combining real and fake information to open new accounts, secure loans or commit other types of fraud. In extreme cases, a breach in a major financial institution can lead to cascading failures in interconnected systems, potentially triggering broader financial instability.

Insiders have repeatedly told PYMNTS that modern technologies like artificial intelligence (AI) could supercharge the capabilities of bad actors by providing turnkey and scalable cyber tools, including AI-generated voice clones and other techniques that can be used for nefarious purposes.

See also: Fresh Wave of Major Cyberattacks Exposes Key Enterprise Security Weaknesses

What Organizations Can Do to Stay Safe and Secure

PYMNTS Intelligence data shows that about a third of Big Tech and FinTech firms have experienced fraud in recent months. The report, a collaboration with Hawk AI, founds that about 43% of financial institutions (FIs) in the U.S. experienced an increase in fraud this year relative to 2022, resulting in a rise in fraud losses increasing by about 65% from $2.3 million in 2022 to $3.8 million in 2023.

But already the marketplace is responding. On Tuesday (July 9), fraud data sharing consortium Sonar launched a new service that helps banks and FinTechs verify if their customer data has been compromised in a breach or used for fraudulent activities.

This new service, Red Flag, allows organizations to proactively check if an account’s credentials are exposed on the dark web.

And separate PYMNTS Intelligence found that 63% of CFOs surveyed reported using some level of specialized automation for fraud prevention in the last six months. That’s because there’s been an increasing awareness of the value of using technologies to wage the war against the fraudsters. Since the dark days of the pandemic, as reported here, disruptions and the shift to digital channels as a chief way of conducting business resulted in 56% of companies investing in more robust fraud defenses.

Still, low-hanging fruit exists in the cybercrime prevention orchard, too. Implementing stronger encryption and MFA can significantly reduce the risk of data breaches, and educating consumers on how to protect their personal information and recognize potential scams can reduce the risk of exploitation following a breach.