Finance and Insurance In 2026: No New Threat but a Different Point of Impact

The categories of attack we observe against banks and insurers have not changed since our 2024 edition. What has changed is where the risk lands: a shared provider, a legitimate session, a help desk that resets an access. Quentin Siennicka, who leads CTI operations at Citalid after ten years of cyber threat analysis in two French ministries (armed forces, interior) and then at Wavestone, walked through it at the Threat Signal webinar of September 24, 2026, around three words: legitimacy, concentration, acceleration. Here is what to take away from it.

Known risks that became tangible

“There is no new category of threat. It’s a change in where the cyber risk actually hits,” Quentin sums up. In earlier editions we already described dependency on third parties, identity abuse, and an increasingly capable cybercrime ecosystem. Today those risks have materialized: a single provider can expose several financial institutions at once, an attacker no longer needs to break authentication if they can obtain a legitimate session or convince a help desk, and artificial intelligence is reducing the human effort needed at some stages of an intrusion.

One caution on how to read the numbers. Data exploitation and resale account for 28.9% of documented incidents, fraud for 19.4% and extortion for 9%, but this is not a ranking of severity: a single extortion incident can cost far more than many data resale events. Our own observation has also changed scale. We collect far more incidents than in 2023, and our threat mapping draws on them: we now document four times as many banking malware families as in 2024, partly because the threat is growing, partly because our dataset has grown.

Legitimacy: attackers no longer need to force the door

In this edition, insurance has a threat profile of its own, instead of being treated as a subset of banking. Three characteristics make it valuable to its customers, and the same three make it attractive to attackers. First, data density: for a single person, an insurer can hold identity data, financial data, claims history and, depending on the line of business, health data. Second, intermediation, since brokers and service providers take part in every step of the customer relationship. Third, identity verification: call centers can reset an authentication, change contact details or confirm an identity, which puts them at the heart of the identity infrastructure rather than at its edge.

The incidents bear this out. Erie Insurance, Philadelphia Insurance, Aflac, Allianz Life and Farmers Insurance reported compromises that exposed customer data, sometimes through third-party providers. Google warned US insurers as early as June 2025, and Google and Mandiant note that several of these operations show characteristics associated with the Scattered Spider ecosystem, notably the exploitation of help desks and identity verification procedures. Taken one by one, these cases are independent campaigns; taken together, they point to a lasting interest in the sector. In Europe, ENISA places Akira among the most active groups against financial institutions, with activity concentrated on insurance. The logic fits in one sentence: “The attacker doesn’t break authentication, they get the organization to hand over the valid access.”

Does that make multi-factor authentication obsolete? Quite the opposite: “It used to be a good practice; now it’s the baseline.” The 2025 CBEST results from the Bank of England, published in January 2026, offer an encouraging illustration: MFA no longer appears among the recurring weaknesses observed across the thirteen firms and financial market infrastructures assessed. The same document does point to help desks as credible access routes, which shifts the problem: what good is an MFA that a simple phone call can get reset? One inexpensive measure, which breaks many social engineering scenarios, is to have the help desk call the employee back on the number already on file, not the one given during the call, before any password or factor reset.

The same logic of legitimacy explains how mobile banking fraud is evolving. Nearly forty families of mobile banking trojans were documented over the period, against about a dozen in the previous edition. The most recent ones no longer just steal credentials: they take control of the phone and run the fraud from the victim’s own device, so the device, the location and the login habits all look normal. Herodotus even varies its typing speed to mimic human behavior. These tools are sold as services and now explicitly target Western Europe, France included. In the fraud category, state actors account for 35.7% of incidents, driven by North Korea, whose crypto thefts exceeded two billion dollars in 2025 according to Chainalysis.

Concentration: one provider, several institutions hit

In August 2025, Marquis Software Solutions, a customer relationship and data management provider for more than 700 US banks and credit unions, was compromised by ransomware. The data of 672,075 people, spread across 74 client institutions, was exposed without those institutions’ own systems being directly breached. The story does not stop at the technical level: Marquis sued SonicWall, whose cloud backup service was the entry point, while facing around 36 consumer class actions itself. The legal and regulatory risk becomes distinct from the breach itself.

Three other documented incidents over the period follow the same pattern. The compromise of Toppan Next Tech, a printing provider, led to the extraction of customer data from DBS Bank and the Singapore subsidiary of Bank of China, with roughly 8,200 DBS customers and 3,000 BOC customers potentially affected. SitusAMC, which specializes in residential mortgage loan management, notified JPMorgan Chase, Citigroup and Morgan Stanley of a data exposure. In Brazil, C&M Software, a payment processing provider, was compromised through the sale of access credentials by an employee, exposing at least six institutions for documented damage above 100 million dollars via the Pix instant payment network. In France, the claimed attack against Harvest, a software provider for banks, insurers, asset managers and wealth advisors, blocked its O2S wealth management tool from February 27, 2025, still unavailable on March 4, before the exfiltrated data was published as part of a double extortion.

For Marquis, Toppan Next Tech and C&M Software, no bank system was the entry point. SitusAMC did not disclose the method or the scale of the exposure, and Harvest is not a bank: those two cases illustrate concentration, not entry through the provider. Hence the observation: “The technical victim and the economic victim are not always the same organization anymore.” A third-party inventory tells you who your suppliers are, not how far a compromise would spread. Four questions, asked for each provider, help measure it:

• Which critical function does this provider support?
• Which data or privileged access does it hold?
• How many organizations or business processes depend on that same function?
• What would the downstream consequences be if this provider were compromised?

“Start from the dependency, not from the vendor list,” Quentin insists: a small provider can be critical if it holds privileged access or supports a function that is hard to replace quickly, as Toppan Next Tech showed. This reading is what produces a quantifiable scenario: how often this type of event occurs, which the threat data Citalid collects helps estimate, combined with the cost of each occurrence (interruption, notification, legal fees, follow-on fraud). For a CISO, it is also a number that can be defended in front of the executive committee, which a vendor list cannot provide. The report assesses it as highly likely that this type of incident will repeat over the next 12 to 18 months.

Supervisors are following. DORA now treats dependency on a third party as a component of operational risk in its own right, the European Central Bank makes cyber resilience, critical providers and concentration risk an on-site inspection focus in its 2026-2028 priorities, and, according to Quentin, it has asked the hundred largest euro area banks for an action plan by October 31. On this topic, see also our page on third-party cyber risk management.

For an insurer, the same logic reads as accumulation. A compromise at a key provider can expose policyholder data, but it can also cause a business interruption whose exposure grows with duration, from several days to several weeks in the worst scenarios. Jaguar Land Rover gave a catastrophic example in 2025. Quentin expects further cases over the next 12 to 18 months, not only on business components like Harvest, but also on support activities: a cloud provider, a VPN provider, CRM functions, essential to the business without being at the core of its activity. To model that accumulation, see our approach to systemic cyber risk modeling.

Acceleration: known flaws exploited faster than the sector can fix them

According to Google, the average time to exploit a vulnerability fell from 63 days in 2018 to an estimated under 7 days in 2025. Quentin, who advised organizations before joining Citalid, recalls that applying a critical patch in under 30 days was already a fight, even on simple middleware components like Apache supporting sensitive applications, which have to be tested with the business. Today, those 30 days are a month of open exposure.

The problem is sharper for legacy systems: mainframes and decades-old applications still run critical functions (accounts, payments, clearing), with availability requirements that limit maintenance windows. The Bank of England flagged delayed patching among its recurring weaknesses for the third consecutive cycle. Our assessment is that the medium-term risk lies less in new vulnerabilities than in known weaknesses becoming exploitable faster than the sector’s correction processes. The answer cannot rest on patch speed alone: the effect of a compromise has to be limited before the patch, through segmentation, reduced privileges and protection of administration interfaces.

Artificial intelligence speeds this dynamic up on two levels that need to be kept apart. The first, established, is assistance: lures, translation, code adaptation, debugging, running criminal platforms. The second involves models or agents taking over part of the attack chain. The webinar recalled the incident involving OpenAI and Hugging Face in summer 2026, where models tested with reduced safeguards exploited a zero-day flaw in their test environment, then carried out reconnaissance, privilege escalation and lateral movement in part of Hugging Face’s infrastructure. That case demonstrates a capability, not an operation against the financial sector: “Cost and visibility are the real brakes today, more for criminals than for states.” Open models, which can run on one’s own infrastructure, do escape the visibility of commercial providers: what we document is a floor, not a full picture. In the short term, Quentin is less worried about a fully autonomous attacker than about attackers delegating more tasks and moving faster, against a defense held back by legacy systems, availability requirements and dependencies.

A last point: AI agents deployed inside the organization itself, which the report treats as new privileged identities. Who is responsible for what an agent does with a senior executive’s access does not yet have a clear answer. A practical principle: treat the agent like a new hire, with an identified owner, limited rights, activity logs and a way to switch it off when it goes wrong.

In France, denial of service remains the most visible threat

Pro-Russian activists, including NoName057(16), claim numerous attacks against the French banking sector, generally with limited impact. But when unavailability hits the customer journey, the effect changes scale: in December 2025, a massive DDoS attack on the La Poste group cut La Banque Postale customers off from the mobile app, with a temporary fallback to SMS validation.

Map trust, not just assets

To close the session, Marie Giesbert asked Quentin what he would do differently after this overview. His answer: “Map trust, not just the assets.” A risk analysis maps assets, but rarely the trust placed in providers and information systems, even though a compromised identity, session or business relationship lets an attacker act with legitimate access or spread the impact beyond the first system hit. That is the common thread across the three themes: in each case, attackers increasingly succeed by exploiting something the organization already trusts.

Frequently asked questions

Is MFA no longer enough?

It remains essential, and it is now a baseline rather than a good practice. Its limit shows up when a reset goes through a call to the help desk: the attacker does not have to bypass MFA, they get it reset for them. Hence the importance of calling back on a number already on file.

Why worry about extortion if it only accounts for 9% of incidents?

Because that percentage measures frequency, not severity. A single incident can combine business interruption, data exposure, restoration costs, regulatory consequences and reputational damage. The model is also changing: double extortion, long dominant, is becoming less frequent overall, because maintaining ransomware requires cryptographic upkeep and evolving code, while data extortion costs the attacker less and lets them resell the data to the highest bidder. The consequence: good backups are no longer enough, you also need to detect data leaving your environment and prepare the notification and legal side. This form of extortion is also quieter, since it does not always cause an interruption, which leaves a share of attacks under the radar when the victim manages to negotiate non-publication.

Does a recent data leak increase fraud risk?

Yes, and not only in the short term. Targeted data has several lives after its disclosure: real fraud attempt emails are starting to appear, and layering several sources makes it possible to build increasingly credible scenarios, particularly when the data comes from a regulatory authority whose image is then used to establish trust. Phishing is no longer a single email that is easy to spot, but a series of messages that build trust. Processes therefore need to make it easy to detect the unusual and to ask for a second pair of eyes.