Financial Services — Cyber Threat Activity

Financial services is the most heavily defended sector in this dataset, and its numbers should be read in that light: more than 950 recorded incidents across 85 countries, over 230 in the trailing 180 days, with 74 groups attributed at least one claim. Qilin (116), Akira (75), RansomHub (39), Play (36) and KillSec (33) lead, and the volume concentrates on credit unions, brokerages, insurers-adjacent processors and regional banks rather than on the largest institutions, which are the hardest targets and the best at absorbing an incident quietly. Elastic's analysis of a South Asian financial-services intrusion illustrates the common shape: entry through an exposed database service, rapid credential and account creation, tooling side-loaded inside legitimate software, then bulk exfiltration to cloud storage and log wiping, all executed as a smash-and-grab rather than a long occupation. The sector also carries the heaviest state-sponsored overlay outside government. Our graph records 257 groups in total once profile-level research associations are included, and it is the one commercial sector where a nation-state may attack for revenue rather than intelligence: North Korean units have pursued banks and payment infrastructure as a funding stream, not an espionage objective. Recorded geography is dominated by the United States at 599 claims, then the United Kingdom, Canada, India, Australia and Germany. Because regulated institutions disclose under supervisory obligation and rarely appear on leak sites, the visible population here under-represents the sector's true incident rate more than any other in this dataset; a low claim count for a bank is evidence about disclosure behaviour, not about whether it was attacked.

All sectors

Recent incidents

Threat actors targeting Financial Services

Where these victims are

Malware used against Financial Services

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 95.5% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions