Why Britain’s banks could be next in line for an ‘atomic-scale’ blackout
A global tech meltdown on Friday paralysed parts of banks, the NHS and global transport systems.
School children were sent home on the last day of term and businesses were forced to accept just cash as electronic payment systems went down.
Worldwide disruption was thought to have been caused by just one botched software update carried out by cyber company Cloudstrike – a business valued at more than $80bn (£62bn) responsible for developing critical cyber security software used by thousands of businesses.
While its CEO later insisted the issue had been resolved, confirming it was not down to any form of attack, it came too late for those holiday makers and travellers stuck in queues around the globe and businesses that have lost out on trade.
Now cyber security experts believe the IT outage could be just the “tip of the iceberg”.
Blackouts are predicted to become more commonplace as a result of an “over-reliance” on cloud infrastructure, which has seen banks allow third-party companies to store customer data. There are fears that the industry has left itself vulnerable to security breaches on an “atomic” scale.
A host of high street and challenger banks including Lloyds, HSBC, NatWest and Monzo now rely on cloud services from firms such as Google, Amazon Web Services and Microsoft Azure to store big pools of data.
UK banks were widely unaffected by the outage on Friday, although banks in Australia and New Zealand reported customers were unable to make transactions or access online accounts.
The Bank of England (BoE) warned in December that the increased reliance on a concentration of cloud servers could pose a risk to the UK’s financial stability should the technology “fail or be disrupted”.
Tayo Dada, head of cyber security at private investigation firm Conflict International, said Friday’s outage was a prelude to things to come.
“What’s happened today is just the tip of the iceberg, literally the tip,” he said.
“Banks are now heavily reliant on cloud software, so they’re dependent on other companies to run their operations.
“That can be great when everything is interconnected for ease of access, but when it goes wrong, it can go seriously wrong like today.
“The fact that banks and other services so heavily rely on third parties has put us in a position of being heavily exposed. One thing can go wrong and there’s massive disruption and billions of pounds is lost.”
Cybercrime is now the biggest crime by volume in the UK, costing the economy an estimated £27 billion a year. Mr Dada said cloud servers have a target on their back because they cater for so many major clients.
“Rogue nations could just target one organisation and bring down loads of others,” he said
“Hackers are realising that if they go against the few that serve the many clients, they can kill more than one bird with a stone.
“Because of this, the attacks are going to be less but more critical. There will be less outages but when they do occur, it’ll be atomic.”
The BoE ran a consultation on cloud server regulation, alongside the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA). The survey ran until March this year and results are yet to be published.
Graeme Stewart, of cyber security firm Check Point, said financial services were facing increased threats.
“The number of attacks is going up and up all the time,” he said. “I’ve been doing it for 25 years and I’ve never seen it like this.”
Check Point data shows that the average UK firm in the finance sector has faced more than 890 attacks per week over the past six months.
The rise in attacks and predicted outages in the financial sector have sparked calls for people to ensure they are never cashless. In 2022, just 14pc of payments were made using cash while a decade ago the figure was 54pc.
In recent years, the Swedish agency for civil contingency handed out leaflets to every household informing them of the value of storing emergency cash at home. Official guidance from the United States government also advises residents to “keep a small amount of cash at home in a safe place”.
Mark Jones, of law firm Payne Hicks Beach, said: “We’re reliant on technology for more or less everything now so when it doesn’t work the consequences can be quite catastrophic.
“I suppose nothing is risk-free but customers need to understand the risks that online mobile banking presents. Identity theft, phishing, malware, unauthorised transactions, card details being accessed – there are lots of things that can happen.”
How to protect yourself
While customers cannot prevent a cloud server from malfunctioning or being hacked, they can protect their individual banking accounts.
Customers are advised to use biometrics to bolster security on their banking apps. Fingerprint identification and facial recognition software has been increasingly rolled out by providers in recent years.
Mr Stewart, of Check Point, said: “You absolutely should be making sure those things are enabled. I know it feels inconvenient having to do the extra step, but you should absolutely always do it. I’ve got it on every single app I use.”
Consumer group Which? last year found that receiving a one-time passcode by SMS to validate banking access was the least secure way to authenticate customers because criminals were increasingly intercepting such texts.
The consumer group instead awarded top marks to banks that asked customers to use a card-reader to confirm payments.
Mr Stewart also said customers should not save their card details on websites for future purchases.
“It seems great as you can buy things with just a click, but it’s not worth it,” he said. “Anything that exposes you, even in the slightest, you should try and avoid.
“I also wouldn’t encourage anyone to use a Wi-Fi network that they don’t know for banking.
“It’s also best practice when closing a banking app on your phone, to always log out rather than just swiping the app to close it. In some cases like NatWest, you’re automatically logged out when you leave the app, but with others it can still running in the background.
“Your phone should fundamentally be safe, but in this day and age, suspicion is absolutely the right approach. Suspicion is your friend.”