EU eyes spot checks as Lloyds Bank hit by cyber attack

The EU is considering testing banks’ defences against cyber attacks, EU officials said, as concerns grow about the industry’s vulnerability to hacking.

It emerged yesterday that Lloyds Bank is working with law enforcement agencies to trace who may be behind a cyber attack that caused intermittent outages for customers of its personal banking websites almost two weeks ago, according to a source.

Lloyds said it would not speculate on the cause of the attack. No customers suffered any losses.

Britain’s largest mortgage lender was hit by a distributed denial of service or DDoS attack on January 11, which carried on for two days, according to the source.

“Only a small number of customers experienced problems,” the bank said.

“In most cases if customers attempted another log in they were able to access their accounts.”

The disruption, which involved bombarding the websites with huge volumes of traffic from multiple systems so they overload a server, left some customers temporarily unable to use services such as checking their balance or sending payments.

Cyber attacks against banks have increased in numbers and sophistication in recent years, with criminals finding new ways to target banks beyond trying to illicitly obtain details of their customers’ online accounts.

But complex cyber attacks have kept rising, as revealed in November by Swift in a letter to client banks and by the theft of £2.5m (€2.88m) from Tesco’s banking arm in the first mass hacking of accounts at a western lender.

Last February, $81m (€75.6m) was taken from the Bangladesh central bank when hackers broke into its system and gained access to the Swift international transactions network.

Global regulators have tightened security requirements for banks after that giant cyber fraud, one of the biggest in history, and in some countries have carried out checks on lenders’ security systems.

Banks “are struggling to demonstrate their ability to cope with the rising threat of intruders gaining unauthorised access to their critical systems and data,” a report of the European Banking Authority (EBA) warned in December.

The next step from European regulators to boost security could be an EU-wide stress test.

The Commission is assessing additional initiatives to counter cyber attacks.

“These include cyber-threat information sharing or penetration and resilience testing of systems.”

The ECB announced last year it would set up a database to register incidents of cyber crime at commercial banks in the eurozone.

Reuters