The global financial services industry is facing a growing and alarming threat in the form of Vendor Email Compromise (VEC) and Business Email Compromise (BEC) attacks. Over the last year, VEC attacks have witnessed a staggering 137% increase, posing significant risks to the industry’s security. These attacks mainly involve socially engineered email attacks, with financial institutions receiving an average of 200 advanced attacks per 1000 mailboxes each week. To understand the severity of this issue, it is important to delve into the statistics and examples that highlight the magnitude and intricacy of these attacks.
Statistics on DDoS attacks
According to recent reports, the financial services industry has become a prime target for VEC attacks. In just one year, there has been a massive increase of 137% in these attacks. Socially engineered email attacks, designed to manipulate recipients, account for the majority of these threats. Financial institutions, on average, face 200 advanced attacks per 1,000 mailboxes every week, indicating the relentless nature of these attacks and the urgent need for heightened security measures.
Peak attack periods
Notably, VEC attacks exhibit certain peak periods throughout the year. Late January, late September, and mid-December have emerged as critical periods when the financial sector experiences a surge in attacks. These periods coincide with various financial activities and holidays, making them opportune times for threat actors to exploit vulnerabilities within email communications.
Understanding Vendor Email Compromise (VEC)
VEC is a form of cyberattack in which threat actors impersonate legitimate business providers, such as vendors or suppliers, to manipulate financial transfers. By gaining access to email accounts of these trusted entities, attackers exploit their relationships with financial institutions to trick individuals into executing fraudulent transactions. This form of attack relies heavily on social engineering techniques and the manipulation of trust to deceive recipients.
High-Value VEC attacks
Reports have revealed instances of VEC attacks targeting millions of dollars, highlighting the devastating impact they can have on financial institutions. One alarming case involved a staggering $36 million being targeted through a VEC attack. This case serves as a striking example of the financial repercussions that can be inflicted on organizations and the urgent need for robust security measures.
In another instance, an Australian financial holding company fell victim to a meticulously orchestrated $1.4 million VEC attack. The detailed example illustrates the intricacy and sophistication of these attacks, revealing the extent to which threat actors can exploit vulnerabilities in the financial services industry.
Rise in Business Email Compromise (BEC) attacks
The financial services industry has not only witnessed a surge in VEC attacks but has also experienced a 71% increase in Business Email Compromise (BEC) attacks in recent years. BEC attacks, unlike typical cyberattacks, do not rely on malicious links or attachments but instead leverage social engineering tactics to manipulate individuals into compromising financial information or executing fraudulent transactions. This makes BEC attacks particularly difficult to detect and prevent using traditional security tools.
Effectiveness of Business Email Compromise (BEC) Attacks
Despite lacking the typical indicators of a cyberattack, BEC attacks have proven to be highly effective in breaching organizational defenses. In fact, text-based BEC attacks recorded a median open rate of nearly 28% last year alone. This staggering open rate highlights the success of these attacks, emphasizing the importance of employee awareness and enhanced security measures to combat this growing threat.
Challenges posed by advanced attacks
VEC and BEC attacks pose significant challenges to the financial services industry, both in terms of legacy email security systems and human vigilance. These attacks have become increasingly sophisticated, combining authenticity with subtle changes to evade detection. The ability of threat actors to exploit trust and manipulate financial transactions requires a comprehensive approach to security, blending advanced technologies, employee training, and ongoing assessment.
The increasing prevalence and efficacy of Vendor Email Compromise (VEC) and Business Email Compromise (BEC) attacks in the global financial services industry demand immediate attention. The statistics and examples presented highlight the urgency for enhanced security measures and increased employee awareness. Financial institutions must invest in robust security solutions, raise awareness about these attacks, and regularly assess and update their defenses to stay ahead of the evolving threat landscape. Only with a multifaceted approach can the industry safeguard itself against these sophisticated attacks and protect the financial well-being of organizations and individuals alike.