What a Cyberattack Can Do to a Bank Without Making the Bank Insolvent

Availability: the bank may still have the money but customers cannot reach it

If mobile banking, online banking, card authorisation or payment processing becomes unavailable, customer access can fail even though the underlying deposits remain on the bank’s ledger.

A service outage therefore creates a gap between the legal claim and the operational ability to use it.

deposit still exists → access channel fails → customer cannot exercise the claim normally.

Integrity: the more frightening failure is not knowing whether the record is true

A system outage is visible. Data corruption can be harder because the system may continue operating while producing untrustworthy results.

If transaction records, balances or instructions are altered, the bank must determine which record is authoritative before it can safely continue processing.

Integrity failure therefore attacks the bank’s ability to reconstruct truth.

Confidentiality: stolen data can create losses after the original breach

Customer identities, account details, internal credentials or transaction information can be exposed. The immediate event is data loss. Later events can include impersonation, fraud, regulatory consequences and loss of trust.

The financial consequence can therefore arrive long after the first technical compromise.

Cyber risk is operational risk with adversarial pressure

A hardware fault and a deliberate cyberattack can both stop a service. The difference is that an attacker may adapt to the bank’s response, seek persistence, manipulate evidence or target the recovery process itself.

This makes cyber resilience a specialised part of operational resilience rather than a separate universe.

The Basel Committee’s current Operational Resilience guidance includes resilient ICT and cyber security as a core principle.

A cyberattack can stop payment processing without changing asset quality

Imagine a bank whose mortgage borrowers continue paying and whose securities remain sound. A cyber incident disables the payment engine for six hours.

The bank has not suddenly become insolvent. Yet customers cannot complete transfers, merchants face uncertainty and operations must reconcile queued or failed transactions after recovery.

The incident is severe because banking is a service that has to work on time.

Fraud can convert cyber compromise into direct financial loss

If an attacker gains control over an authorised account or payment process, unauthorised value can move. The bank can then face reimbursement, investigation, legal and operational costs depending on the facts and applicable rules.

Article 59 owns the customer-level path: Account Takeover | How Identity Failure Becomes Banking Loss.

Ransom and extortion create a decision problem as well as an outage

A cyber incident can include demands intended to pressure the bank. The institution must coordinate legal, regulatory, operational, law-enforcement and security considerations while preserving critical operations.

The durable banking lesson is not about one extortion technique. It is that crisis governance must exist before an adversary places the bank under time pressure.

Cyberattack can create liquidity pressure through confidence

Customers may move deposits if they fear prolonged access problems or doubt the integrity of the institution’s systems. Counterparties can become more cautious. Funding conditions can tighten.

An operational incident can therefore become a liquidity incident even when the bank’s underlying assets remain solvent.

Read What a Bank Liquidity Buffer Is Actually For.

Market confidence can punish uncertainty more than the known loss

If the bank cannot say which systems were affected, whether data remains reliable or when critical operations will return, outsiders must estimate the unknown.

Uncertainty can therefore widen funding spreads or intensify withdrawals beyond the direct technical damage.

Clear, accurate communication is part of cyber resilience because it reduces unnecessary uncertainty without pretending the problem is smaller than it is.

A cyber loss can eventually reduce capital

Fraud, remediation, legal claims, customer compensation, investigation and system rebuilding can reduce earnings. Large losses can reduce retained earnings and therefore capital.

Cyber risk can therefore begin outside the balance-sheet asset-quality problem and end inside the capital layer.

Insolvency is a value problem, not an outage label

A bank is not insolvent merely because systems are unavailable. Insolvency concerns whether losses have reduced the economic value of assets and earning capacity so far that liabilities and required capital can no longer be supported.

A severe cyberattack can ultimately cause enough loss to threaten solvency, but the two states should not be confused.

Containment can require temporarily reducing service

During an incident, the safest action can be to isolate systems, disable functions or slow transactions while the bank establishes what remains trustworthy.

From the customer’s perspective, this can look like the bank failing to provide service. From the resilience perspective, temporary containment can prevent a smaller compromise from spreading.

Recovery must restore trust, not just uptime

A system can be technically online while the bank still doubts whether credentials, data or transaction states are clean. Good cyber recovery therefore includes validation, credential control, reconciliation and evidence that the restored environment is trustworthy.

Restarting is not the same as recovering.

Backups are necessary but not sufficient

A backup can preserve data and still contain compromised information. The bank needs protected recovery copies, tested restore procedures and a method to identify a clean state.

This connects directly to Business Continuity.

Third parties can become the attack path or the failure path

A bank can secure its own systems and still depend on a cloud provider, software supplier, identity service or payment processor. A third-party cyber incident can interrupt the bank’s critical service.

The current Basel Third-Party Risks guidance requires banks to manage the operational consequences of these dependencies rather than treating outsourced services as outside the risk perimeter.

Detection quality changes the loss path

The same technical compromise can create very different outcomes depending on how quickly the bank detects, isolates and understands it.

Early detection can contain the affected scope. Delayed detection can allow corrupted states, fraudulent transactions or compromised credentials to spread deeper into operations.

Incident command must decide from incomplete information

During a major cyber event, the bank rarely knows everything at the beginning. Leaders need a decision structure that can act while uncertainty remains: isolate, prioritise critical operations, preserve evidence, notify where required and continuously update the operating picture.

The quality of crisis governance can determine whether a technical incident stays bounded or becomes an institutional crisis.

Reconciliation closes the recovery loop

After systems return, the bank needs to verify that customer balances, payments, securities, collateral and settlement records agree with independent evidence.

Read Bank Reconciliation.

Testing should attack assumptions, not stage a ceremonial outage

A useful resilience exercise can assume that normal staff are unavailable, the primary communication channel is compromised or one major provider is also disrupted.

The point is to test whether critical operations can survive a severe but plausible world—not merely whether the backup script runs.

The cyber problem survives every technology generation

Specific threats will change. So will operating systems, cloud services, authentication methods and AI tools. The durable questions remain:

• which critical operation depends on this system?
• what happens if access disappears?
• what happens if the data is wrong?
• what happens if identity is compromised?
• which independent evidence can reconstruct the truth?
• how long can the service remain impaired?
• which third party can fail with us?

Four misconceptions to remove

Misconception	Better model
“A cyberattack means the bank has lost all its money.”	Cyber incidents often begin as operational failures; financial losses and solvency effects depend on severity and transmission.
“If systems are back online, the incident is over.”	The bank must validate integrity, reconcile transactions and close customer and control impacts.
“Cyber security is an IT problem.”	It affects critical operations, payments, fraud, legal obligations, liquidity, capital and confidence.
“Backups guarantee recovery.”	Recovery requires clean data, trusted credentials, tested restoration and independent verification.

A mastery test

1. How can a cyberattack severely disrupt a bank without making it insolvent?
2. Why is data integrity sometimes more dangerous than simple downtime?
3. How can a cyber incident become a liquidity problem?
4. Why does recovery require more than restoring system availability?
5. Which questions about critical operations remain useful even when the technology changes?

If those answers connect, cyber risk becomes visible as a banking continuity problem with an intelligent adversary inside it: the balance sheet can still be alive while the institution struggles to prove that its systems, identities and records can still be trusted.

---