The European Central Bank said Wednesday it would test lenders’ response to cyberattacks this year in a first of a kind stress test for banks in the eurozone.
The critical scenario set out by the ECB assumes that the bank has been “hit by successful cyberattack that disrupts their daily operations”, the ECB said in a statement.
Some 109 banks would be tested on their means to “respond to and recover from a cyberattack, rather than their ability to prevent it”, the ECB said.
The exercise will examine financial institutions’ emergency procedures and their plans to restore normality after such an attack.
A subset of 28 banks from across the eurozone would be subjected to a more rigorous test that would take a closer look at the risks of cyberattacks spilling over into other areas.
The results of the exercise, which will be published later this year, would not have an impact on banks’ obligations to build capital buffers against financial risks, the ECB said.
The ECB runs stress tests on the banks it supervises every year to evaluate their preparedness to handle adverse events. While most tests have focused on adverse economic and financial scenarios, the ECB has also run a climate stress test on banks.
The cyber stress tests were announced last year as the risk of hacking attempts was seen to have increased following the pandemic and Russia’s invasion of Ukraine.
“The number of cyberattacks is higher than it was before the pandemic,” Anneli Tuominen a member of the ECB supervisory board, told German daily Boersen Zeitung last year.
The biggest increase was seen in “distributed denial of service attacks, in which perpetrators interrupt banking services by flooding and clogging bank servers with fake requests”, Tuominen said.
There had also been an increase in ransomware attacks, where banks are asked to fork out money to regain access to their data, she said.
“Euro area banks have proven to be resilient so far,” Tuominen said, but warned “a successful attack could occur at any time”.
The ECB’s next round of its standard stress tests, aimed at evaluating banks’ ability to weather various financial risks, will be carried out in 2025.
