New research shows institutions in the financial sector experience up to 300 times more cyberattacks than other sectors, with large banks reporting 45 percent of their employees susceptible to phishing attacks.
The study from KnowBe4 reveals almost all (97 percent) of major US banks experienced third-party breaches in 2024, while targeted intrusions against financial institutions increased by 109 percent year-on-year.
A worrying finding is that tests in large financial institutions found that nearly 45 percent of employees were likely to click on a malicious link or download an infected file, creating entry points for threat actors. Those actors are now leveraging AI tools like FraudGPT and ElevenLabs to create more convincing phishing campaigns, while simultaneously moving away from traditional ransomware encryption toward data exfiltration and multi-stage extortion schemes.
Analysis of over three million dark web posts shows stolen credentials now far outpace credit card theft. Infostealer infection attempts increased 58 percent in 2024 and 68 percent of attacks originating from email.
The report also shows US accounts for 60 percent of all ransomware attacks against financial institutions, with the US and UK together representing over 70 percent of attacks, with increasing activity targeting emerging markets in South Asia and Latin America.
“Adversaries are gaining an advantage against the financial sector,” says James McQuiggan, security awareness advocate at KnowBe4. “Traditional defenses are no longer sufficient and threat actors discovered stealing valid credentials is more effective than ransomware because it allows them to move undetected. The battle comes down to the human level. Financial institutions must prioritize human risk management to close this critical security gap.”
You can get the full report from the KnowBe4 site.
Image credit: Valeriya Ignatenko/Dreamstime.com
