## Appendix 2: Robustness checks for aggregate loss distribution (wp18143)

## Source details

**Canonical URL:** [Appendix 2: Robustness checks for aggregate loss distribution (wp18143)](https://www.imf.org/-/media/files/publications/wp/2018/wp18143.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/wp/2018/wp18143.pdf.md)
- [Structured JSON version](/-/media/files/publications/wp/2018/wp18143.pdf.json)

---

### I. Introduction — context and data limits
- Cyber risk identified as a systemic risk concern (examples: Wannacry May 2017, NoPetya June 2017).
- DTCC Systemic Risk Barometer: Cyber Risk featured prominently in 2016 and 2017.
- Data scarcity and underreporting:
  - 49 cyber-attacks reported in 2017 to U.K. Financial Authorities.
  - Among around 4,000 annual reports for U.S. firms (Form 10-K) published in 2017, 7 percent included a reference to cyber-risk.
  - International data sharing constrained by privacy and national security considerations.
- Regulatory reporting example:
  - GDPR reporting window: 72 hours; fines up to EUR 20 Mn or 4 percent of global annual turnover.
- Main objective: provide framework and quantitative estimates for cyber risk to financial institutions using public and commercial datasets.

### II. Incidence, types, and distribution of cyber-attacks on financial institutions
- Data sources and coverage:
  - ORX News dataset: 341 cyber risk events impacting financial institutions over 2009-2017.
  - About 1/3 of ORX events provide loss data totaling USD 6.5 billion.
  - Dataset likely skewed toward Advanced Economies and English-language reports.
- Geographic distribution (ORX News):
  - Advanced Economies (AEs) account for 80 percent of successful attacks.
  - Country shares: USA 39 percent; GBR 7 percent.
  - BRICS account for 17 percent of attacks: RUS 6 percent; CHN 4 percent; IND 3 percent.
- Institutional and business-line targets:
  - Banks 91 percent of attacks; Insurance 7 percent.
  - Within banks: Retail banking 39 percent; Credit card services 25 percent.
- Types of attacks (ORX News composition):
  - Fraud 43 percent; Data breaches 34 percent; Business disruption 23 percent.
  - Note: business disruption events typically known immediately; fraud and breaches can remain undiscovered for months or years, biasing observed frequency and losses.
- Relationship between size and losses:
  - Direct losses generally unrelated to institution size; largest recorded losses concentrated among smaller institutions in ORX data.

### III. Documented incidents, illustrative scenarios, and sectoral estimates
- Selected central bank and bank incidents (examples and loss figures):
  - Federal Reserve Bank of New York, 2012: USD 9.5 Million (proprietary software code theft).
  - Banco Central del Ecuador, 2013: USD 13.3 Million stolen.
  - Bangladesh Bank, 2016: USD 81 Million stolen; attempted USD 951 Million.
  - Bank of Russia, 2016: USD 22 Million lost.
  - Central Bank of Swaziland, 2014: USD 688,000 stolen.
- Other illustrative estimates and scenarios:
  - ORX News: around USD 6.5 billion in direct losses for 1/3 of events with loss data.
  - Lloyd’s estimate: disruption of the top cloud provider in the U.S. for 3 to 6 days could lead to losses of around USD 24 billion overall; estimated losses for the financial sector USD 450 Mn.
  - Reported macro-infrastructure disruption scenarios (billion USD): Electricity blackout 243-1,024; Cloud Service Providers hack 5-53; Mass vulnerability attack 10-29.
- Fintech and crypto-related losses:
  - Cyber-attacks on Fintech firms (mainly online exchanges and wallets) have resulted in at least USD 1,450 Million in losses due to fraud since 2013.
  - Examples: MT Gox Jan. 2014 USD 470 Mn; Coincheck Jan. 2018 USD 534 Mn; Bitfinex Aug. 2016 USD 72.2 Mn.

### IV. Quantitative framework and estimation approach
- Purpose: apply operational-risk and insurance pricing models to estimate distribution of aggregate financial system losses due to cyber-attacks.
- Aggregate losses model:
  - Z = X1 + ⋯ + XN, with N the number of cyber-attacks per year and Xi positive severities.
  - Frequency: N ~ Poisson(λ).
  - Parameter λ based on Advisen data: average number of cyber events per year over 2011-2016 ≈ 990.
  - Extreme frequency scenario: twice the peak observed in 2013 (1373 events) → 2746 attacks.
  - Expected aggregate losses: E[Z] = λ E[X].
- Severity distribution:
  - Spliced model with threshold u = $119 million:
    - Bulk (x ≤ u): Lognormal LN(μ, σ).
    - Tail (x > u): Generalized Pareto Distribution (GPD) with parameters (ξ, α, β).
  - Average loss in dataset: USD 66 million; median USD 4.7 million; most losses below USD 200 million; outlier around $4,010 million.
- Estimation and simulation:
  - Parameters estimated by maximum likelihood using evmix package in R.
  - Monte Carlo simulations used to compute aggregated losses (baseline 10,000 simulations; alternatives up to 1,000,000).

### V. Contagion modeling and dependence assumptions
- Contagion modeled so each cyber-attack can affect multiple firms; number of losses per event follows a geometric distribution with parameter p = 0.8 (20 percent probability each attack impacts several firms).
- Under Poisson-geometric assumptions:
  - Expected total number of loss events G: E[G] = λ + λ×(1−p)/p.
  - For p = 0.8: E[G] = 1.25 × λ and E[Z] = 1.25 × λ × E[X].
  - Implication: average losses 25 percent higher with contagion.
- Conditional contagion: probability of contagion could increase from 20 percent to 60 percent if losses exceed the 90th percentile (tail-dependent contagion).

### VI. Results — baseline, severe, and contagion-adjusted outcomes (exact figures)
- Baseline case (ORX sample, independence):
  - Average losses: USD 97 billion or 9 percent of banks net income (net income data from 2016 for sample of 7,947 banks).
  - VaR (95%): USD 147 billion (14 percent of net income).
  - VaR (99%): USD 201 billion (19 percent of net income).
  - ES (95%): USD 187 billion (18 percent of net income).
  - ES (99%): USD 281 billion (27 percent of net income).
- Severe scenario (frequency twice 2013 peak):
  - Average losses: USD 268 billion (26 percent of net income).
  - VaR (95%): USD 352 billion (34 percent of net income).
  - VaR (99%): USD 539 billion (52 percent of net income).
  - ES (95%): USD 409 billion (40 percent of net income).
  - ES (99%): USD 539 billion (52 percent of net income).
- Contagion (assuming 20% dependence, each attack has 20% probability to affect two or more firms):
  - Baseline assuming 20% dependence:
    - Average: USD 127 bn (12% net income).
    - VaR (95%): USD 184 bn (18% net income).
    - ES (95%): USD 229 bn (22% net income).
    - VaR (99%): USD 248 bn (24% net income).
    - ES (99%): USD 329 bn (32% net income).
  - Severe assuming 20% dependence:
    - Average: USD 351 bn (34% net income).
    - VaR (95%): USD 446 bn (43% net income).
    - ES (95%): USD 509 bn (49% net income).
    - VaR (99%): USD 529 bn (51% net income).
    - ES (99%): USD 642 bn (62% net income).
- Cross-study comparisons:
  - Symantec (2013): USD 113 billion annual cost of cybercrime.
  - Anderson et al. (2013): USD 215 billion (direct and indirect losses, 2007-2012 data).
  - McAffee (2014): global costs between USD 375 and 575 billion.

### VII. Robustness and sensitivity checks (exact figures)
- Number of simulations (independence case, USD billion):
  - 10,000 simulations: Average 97; Median 92; VaR (95%) 147; VaR (99%) 201; ES (95%) 187; ES (99%) 281.
  - 100,000 simulations: Average 102; Median 96; VaR (95%) 152; VaR (99%) 204; ES (95%) 190; ES (99%) 277.
  - 1 million simulations: Average 101; Median 96; VaR (95%) 151; VaR (99%) 202; ES (95%) 190; ES (99%) 276.
- Alternative bulk distributions (baseline case, USD billion):
  - Lognormal GPD: Average 97; Median 92; VaR (95%) 147; VaR (99%) 201; ES (95%) 187; ES (99%) 281.
  - Normal GPD: Average 114; Median 112; VaR (95%) 146; VaR (99%) 163; ES (95%) 157; ES (99%) 173.
  - Gamma GPD: Average 90; Median 87; VaR (95%) 129; VaR (99%) 159; ES (95%) 150; ES (99%) 191.
- Reported distribution parameters:
  - Tail threshold: 0.12 (Lognormal GPD), 0.03 (Normal GPD), 0.08 (Gamma GPD).
  - Bulk distribution parameters:
    - Lognormal: μ = 1.72; σ = 1.89.
    - Normal: μ = 12.6; σ = 15.7.
    - Gamma: shape μ = 0.46; scale σ = 45.6.
  - GPD parameters:
    - Shape ξ: 0.45 (Lognormal GPD), 0.24 (Normal GPD), 0.39 (Gamma GPD).
    - Scale β: 857 (Lognormal GPD), 852 (Normal GPD), 838 (Gamma GPD).
    - Threshold α: 0.05 (Lognormal GPD), 0.09 (Normal GPD), 0.05 (Gamma GPD).
- Sensitivity to not splicing (pure lognormal):
  - Average losses USD 38 billion; VaR (95%) USD 51 billion; ES (95%) USD 60 billion.

### VIII. Key measurement notes and data limitations
- No common standard to record cyber incidents; firms often lack incentives to report.
- Loss data vary in methodology and typically capture direct losses only; indirect losses (reputation, business recovery, remediation) account for more than 90 percent of total losses per Deloitte (2016).
- Country-level media-based bank cyber-risk index computed over Jan-2014-Sep.2017; index omitted for countries with fewer than 25 articles.
- ORX News coverage: around 341 events, ~1/3 with loss data totaling USD 6.5 billion; ORX consortium holds larger anonymized dataset of ~600,000 risk events.

### IX. Policy implications and recommendations
- Data and measurement:
  - Need for more granular and complete loss and frequency data disaggregated by attack type (data breach, fraud, business disruptions).
  - Develop a consistent framework to collect cyber-risk data to mitigate sample bias.
  - Consider Bayesian methods to mitigate uncertainty regarding cyber losses.
- Supervisory and regulatory actions:
  - Update regulatory and supervisory frameworks to account for cyber risk.
  - Develop capacity to assess key vulnerabilities in financial institutions and FMIs.
- Contingency planning and public intervention:
  - Design contingency plans for large-scale attacks.
  - Implement stress-testing scenarios for business disruption of systemic participants and coordinated attacks on multiple banks.
- Insurance market implications:
  - Cyber insurance premium market size: around USD 3 billion in premium globally in 2017.
  - Expected to reach USD 12 to 20 billion in the next decade.
  - Take-up rates less than 30 percent across sectors; average coverage limit purchased in 2016 around USD 3 million.
  - Pricing and coverage challenges due to correlated exposures and uncertainty.

*Source: IMF Working Paper wp18143 (Appendix 2 content as provided).*

### References .............................................................................................................

### References

### References
- Page: 24

### Appendix 1: Application of the framework for country surveillance
- Page: 27

*Source: wp18143 - References.*

### Appendix 2: Robustness checks for aggregate loss distribution ..............................................28

### Appendix 2: Robustness checks for aggregate loss distribution

### I. Introduction — key context and data limits
- Cyber risk identified as a systemic risk concern in recent surveys and incidents (e.g., Wannacry May 2017, NoPetya June 2017).
- DTCC Systemic Risk Barometer: Cyber Risk featured prominently in 2016 and 2017 survey results (Figure 1).
- Data scarcity and underreporting:
  - Only 49 cyber-attacks were reported in 2017 to U.K. Financial Authorities (Butler (2017)).
  - Among around 4,000 annual reports for U.S. firms (Form 10-K) published in 2017, only 7 percent included a reference to cyber-risk.
  - International data sharing constrained by privacy and national security considerations.
- Regulatory reporting example:
  - GDPR (entering into force May 2018) requires breach reporting within 72 hours; fines up to EUR 20 Mn or 4 percent of global annual turnover (whichever is higher).
- Main objective: provide framework and quantitative estimates for cyber risk to financial institutions using public and commercial datasets.

### II. Overview of cyber-attacks targeted at financial institutions — incidence, types, and distribution
- Data sources and coverage:
  - ORX News dataset: 341 cyber risk events impacting financial institutions over 2009-2017.
  - About 1/3 of ORX events provide loss data, totaling USD 6.5 billion overall.
  - Data bias: dataset likely skewed toward Advanced Economies and English-language reports.
- Geographic distribution (ORX News):
  - Advanced Economies (AEs) account for 80 percent of successful attacks.
  - Country shares: USA 39 percent, GBR 7 percent.
  - BRICS account for 17 percent of attacks: RUS 6 percent, CHN 4 percent, IND 3 percent.
  - Financial institutions in more than 50 countries reported as victims in public media.
- Institutional and business-line targets:
  - Banks account for 91 percent of attacks; insurance companies 7 percent.
  - Among banks, retail banking 39 percent and credit card services 25 percent of attacks.
- Types of attacks (ORX News composition):
  - Fraud 43 percent of events.
  - Data breaches 34 percent of events.
  - Business disruption 23 percent of events.
  - Note: business disruption events are typically known immediately; fraud and breaches can remain undiscovered for months or years, biasing observed frequency and losses.
- Relationship between size and losses:
  - Direct losses generally unrelated to institution size; largest recorded losses concentrated among smaller institutions in ORX data (Figure 7).
- Text-mining patterns (correspondence analysis):
  - Business disruption associated with DDoS, website unavailability.
  - Data breaches linked to credit card information.
  - Fraud associated with money transfers and explicit loss amounts.
  - The word “bank” centrally associated with all attack types.

### III. Selected documented incidents and loss figures (ORX / public reports)
- Central bank incidents (Table 1 selected entries):
  - Federal Reserve Bank of Cleveland, 2010, Data breach: Theft of 122,000 credit cards.
  - Federal Reserve Bank of New York, 2012, Data breach: Theft of proprietary software code worth USD 9.5 Million.
  - Sveriges Riksbank, 2012, Business Disruption: DDoS left website offline for 5 hours.
  - Banco Central del Ecuador, 2013, Fraud: USD 13.3 Million stolen from the account of the city of Riobamba.
  - Federal Reserve Bank of Saint Louis, 2013, Data breach: Publication of credentials of 4,000 US bank executives.
  - Central Bank of Swaziland, 2014, Fraud: Theft of USD 688,000.
  - ECB, 2014, Data breach: 20,000 email addresses and contact information compromised.
  - Norges Bank, 2014, Business Disruption: DDoS on seven large financial institutions, suspended services during a day.
  - Central Bank of Azerbaijan, 2015, Data breach: Theft of thousands of bank customers’ information.
  - Bangladesh Bank, 2016, Fraud: SWIFT credentials used to transfer USD 81 Million; hackers tried to steal USD 951 Million.
  - Bank of Russia, 2016, Fraud: 21 cyber-attacks aimed at stealing USD 50 Million resulted in loss of USD 22 Million.
  - Bank of Italy, 2017, Data Breach: Hack of email accounts of two former executives.
- Other illustrative estimates and scenarios:
  - ORX News: around USD 6.5 billion in direct losses for the 1/3 of events with loss data.
  - Lloyd’s estimate: disruption of the top cloud provider in the U.S. for 3 to 6 days could lead to losses of around USD 24 billion overall; estimated losses for the financial sector in that scenario would be USD 450 Mn.
  - Reported macro-infrastructure disruption scenarios (Table 2):
    - Electricity blackout (Energy infrastructures): 243-1,024 (in billion USD).
    - Cloud Service Providers hack (Cloud Providers): 5-53 (in billion USD).
    - Mass vulnerability attack (Operating System): 10-29 (in billion USD).

### IV. Framework and vulnerability channels for financial institutions
- Risk decomposition used (ISO (2011) formulation):
  - Risk = f (Threat, Vulnerability, Consequences)
- Higher exposure drivers for financial institutions:
  - Elevated threat levels due to cybercrime, hacktivism, proxy organizations, surveillance.
  - High vulnerabilities from dependence on interconnected networks, critical infrastructures, and legacy systems.
  - High consequences because financial activity is dematerialized and reliant on technology.
- Single Point of Failure and critical infrastructures:
  - Critical FMIs include payment and settlement systems, trading platforms, central securities depositories, central counterparties.
  - Business disruption of an FMI or large participants could create liquidity and solvency risk for counterparties.
  - Stress-testing parallels: CCP stress tests assess default of large clearing members and custodian failures; similar frameworks can model cyber-attack-induced disruptions.
- Business disruption impacts:
  - DDoS examples have temporarily suspended online services and trading announcements (e.g., Hong Kong stock exchange website Aug 10-11, 2011).
  - Depositor confidence example: FIB (Bulgaria) on June 27, 2014 — deposit outflows amounted to 10 percent of total deposits on that day; liquidity assistance used.

### V. Data limitations and measurement notes
- No common standard to record cyber incidents; firms often lack incentives to report.
- Data on losses vary in methodology (actual costs, estimated costs) and typically capture direct losses only; indirect losses (reputation, business recovery, remediation) account for more than 90 percent of total losses per Deloitte (2016).
- Country-level media-based bank cyber-risk index:
  - Computed as number of English-language articles mentioning “cyber-attack” or “hack” or “cyber risk” or “cyber security” and “banks” or “bank” and “risk” divided by number of articles featuring “banks” or “bank” and “risk” by country.
  - Period range: Jan-2014-Sep.2017.
  - Index not computed for countries with fewer than 25 articles on cyber risk.
- ORX News coverage: around 341 events, ~1/3 with loss data totaling USD 6.5 billion; dataset covers public reports and is available to ORX members (ORX consortium holds larger anonymized dataset of ~600,000 risk events).

### VI. Key quantitative findings (exact figures preserved)
- 49 cyber-attacks reported in 2017 to U.K. Financial Authorities.
- ~4,000 U.S. Form 10-K annual reports in 2017: 7 percent referenced cyber-risk.
- GDPR reporting window: 72 hours; fines up to EUR 20 Mn or 4 percent of global annual turnover.
- ORX News: 341 cyber events over 2009-2017; ~1/3 provide loss data amounting to USD 6.5 billion.
- Geographic shares: AEs 80 percent of attacks; USA 39 percent; GBR 7 percent; BRICS 17 percent (RUS 6 percent, CHN 4 percent, IND 3 percent).
- Sector shares: Banks 91 percent; Insurance 7 percent.
- Bank business-line shares: Retail banking 39 percent; Credit cards 25 percent.
- Attack-type shares: Fraud 43 percent; Data breach 34 percent; Business disruption 23 percent.
- Selected incident losses and figures:
  - Federal Reserve Bank of New York, 2012: USD 9.5 Million (proprietary software code theft).
  - Banco Central del Ecuador, 2013: USD 13.3 Million stolen.
  - Bangladesh Bank, 2016: USD 81 Million stolen; attempted USD 951 Million.
  - Bank of Russia, 2016: USD 22 Million lost.
  - Central Bank of Swaziland, 2014: USD 688,000 stolen.
- Infrastructure disruption scenario losses (billion USD): Electricity blackout 243-1,024; Cloud Service Providers hack 5-53; Mass vulnerability attack 10-29.
- Lloyd’s cloud-provider disruption estimate: USD 24 billion overall losses for 3–6 day outage; USD 450 Mn financial-sector losses.

### VII. Implications for measurement and policy (from text)
- Need for improved and harmonized reporting frameworks for cyber-attacks to address existing data gaps.
- Financial institutions are logical initial focus for data collection given regulatory operational-risk reporting requirements and concentration of attacks on financial sector.
- Stress-testing frameworks used for CCPs could be adapted to assess consequences of cyber-induced business disruption for FMIs and large participants.
- Recognize indirect losses (reputational, remediation, business recovery) substantially exceed direct losses and must be integrated into aggregate loss assessment.

*Source: IMF working paper (Appendix 2 content as provided).*

### Box 1: DDoS attacks on multiple financial institutions

### Box 1: DDoS attacks on multiple financial institutions

### DDoS incidents on financial institutions
- US: In September 2012, the websites of Bank of America, PNC, JPMorgan, US Bancorp, Wells Fargo were targeted and one month later the websites of BBT, Capital One, HSBC, Region Financial, SunTrust were also disrupted.
- Czech Republic: On March 6, 2013, the websites of the central bank, three large banks and the stock exchange were disrupted, with limited damages estimated at USD 0.5 Million.
- Norway: On July 8, 2014, seven major financial institutions were attacked, leading to disrupted services during the day.
- Finland: End-2014, three banks (Op Pohjola, Danske Bank and Nordea) suffered DDoS attacks that rendered their online services unavailable and for one bank prevented customers from withdrawing cash and making card payments.

### Fraud and SWIFT-related losses
- Cyber-related fraud accounts for 90 percent of reported losses in the dataset.
- Over the last three years, at least ten attacks were based on the SWIFT system. Hackers accessed victims’ SWIFT credentials and sent fraudulent payment orders on behalf of the target (EM banks) to the hackers’ bank accounts—in some cases transiting through AE banks and central banks.
- Initial losses amounted to USD 336 Million, while actual losses were around USD 87 Million, as some orders were frozen and some money was recouped.

Table of cyber-attacks using SWIFT (as provided)
- Banco del Austro (Ecuador) — Date: Jan. 2015 — Initial losses (USD million): 12.2 — Current estimated losses* (USD million): 9.4
- Bangladesh Central Bank — Date: Feb. 2016 — Initial losses (USD million): 81 — Current estimated losses* (USD million): 66
- Union Bank of India — Date: Jul. 2016 — Initial losses (USD million): 171 — Current estimated losses* (USD million): 0
- TP Bank (Vietnam) — Date: May 2016 — Initial losses (USD million): 1 — Current estimated losses* (USD million): 0
- Akbank (Turkey) — Date: Dec. 2016 — Initial losses (USD million): 4 — Current estimated losses* (USD million): 4
- Far Eastern International Bank (Taiwan, Province of China) — Date: Oct. 2017 — Initial losses (USD million): 60 — Current estimated losses* (USD million): 0.5
- NIC Asia Bank (Nepal) — Date: Oct. 2017 — Initial losses (USD million): 4.4 — Current estimated losses* (USD million): 0.6
- Globex (Russia) — Date: Dec. 2017 — Initial losses (USD million): 1 — Current estimated losses* (USD million): 0.1
- Unidentified bank (Russia) — Date: Dec. 2017 — Initial losses (USD million): Unknown — Current estimated losses* (USD million): 6
- City Union Bank (India) — Date: Jan. 2018 — Initial losses (USD million): 2 — Current estimated losses* (USD million): Unknown

*Current estimated losses are based on publicly available information. Targeted institutions are in the process of recovering the losses through legal proceedings.

### Fintech exposures and losses
- Emerging technologies such as Fintech are particularly exposed to cyber-attacks due to reliance on technology, potential fewer controls and risk management procedures, expanded entry points, and increased third-party reliance.
- Cyber-attacks on Fintech firms (mainly online exchanges allowing the trading of Bitcoins and providing wallet services) have resulted in at least USD 1,450 Million in losses due to fraud since 2013.

Table of cyber-attacks on Fintech firms (as provided)
- Inputs.io — Date: Oct. 2013 — Estimated losses (USD Mn): 1.3
- GBL — Date: Oct. 2013 — Estimated losses (USD Mn): 5
- Bitcoin Internet Payment Services — Date: Nov. 2013 — Estimated losses (USD Mn): 1
- MT Gox — Date: Jan. 2014 — Estimated losses (USD Mn): 470
- BitPay — Date: Dec. 2014 — Estimated losses (USD Mn): 1.9
- EgoPay — Date: Dec. 2014 — Estimated losses (USD Mn): 1.1
- Bitstamp — Date: Jan. 2015 — Estimated losses (USD Mn): 5.3
- Bitfinex — Date: May. 2015 — Estimated losses (USD Mn): 0.3
- Gatecoin — Date: May 2016 — Estimated losses (USD Mn): 2
- DAO Smart Contract — Date: Jun. 2016 — Estimated losses (USD Mn): 50
- Bitfinex — Date: Aug. 2016 — Estimated losses (USD Mn): 72.2
- CoinDash — Date: Jul. 2017 — Estimated losses (USD Mn): 7
- Tether — Date: Nov. 2017 — Estimated losses (USD Mn): 31
- NiceHash — Date: Dec. 2017 — Estimated losses (USD Mn): 64
- Coincheck — Date: Jan. 2018 — Estimated losses (USD Mn): 534
- BitGrail — Date: Feb. 2018 — Estimated losses (USD Mn): 170
- Coinsecure — Date: Apr. 2018 — Estimated losses (USD Mn): 33

### Interconnectedness and contagion examples
- High interconnectedness across firms and supply chains can lead to rapid contagion from a successful attack.
- June 2017 ransomware targeting Ukraine led to losses of at least USD 1.3 billion for multinational firms across sectors linked to Ukrainian companies. Individual firm estimates include:
  - Saint Gobain: losses of around USD 350 Mn in July 2017
  - A.P. Møller-Mærsk: USD 200-300 Mn
  - Merck: USD 310 Mn
  - Mondelez: USD 100 Mn
  - Fedex TNT Express: USD 300 Mn
- For financial institutions, disruption of one large bank could spread quickly to counterparties and financial market infrastructures, heightening liquidity and solvency risk.

### Data breaches and estimated costs
- The financial sector suffered the most incidents with data loss in recent years, including the Equifax data breach where hackers may have stolen personal information of more than 145 million U.S customers.
- In the U.S. alone, more than 260 million records were breached due to hacking over the last three years in the financial sector.
- The Ponemon Institute estimates that the average cost per stolen record was USD 141 in 2017.
- Applying the Ponemon estimates, losses due to data breach over the last three years would be around $38 billion for U.S. financial firms alone.

### Quantitative framework for analysis of cyber risk — overview
- Purpose: Illustrate how models for operational risk assessment and insurance pricing can be applied to estimate distribution of aggregate financial system losses due to cyber-attacks; useful for regulators and firms required to hold risk capital for operational losses.
- Data source: Data on cyber-attacks extracted from ORX News. All losses expressed in U.S. dollars and adjusted for inflation.
- Methodology summary:
  - Fit losses using a lognormal distribution for the body and extreme value theory for the tail.
  - Estimate average loss and risk measures: value at risk (VaR) and expected shortfall (ES).
  - Compute aggregated losses with Monte Carlo simulations, assuming frequency of each cyber event follows a Poisson distribution.

### Estimation of aggregated losses — formal setup
- Aggregate losses Z due to cyber risk are given by:
  - Z = X1 + ⋯ + XN
  - Frequency N is a discrete random variable — the number of cyber-attacks per year.
  - X1, ..., XN are positive random severities (losses).
  - Assumption: N and Xi are independent.
- Frequency model:
  - N ~ Poisson(λ).
  - The probability that k cyber incidents arise over a year: pk = Pr[N = k] = λ^k / k! × e^(−λ).
  - Parameter λ is based on the average number of cyber events per year over the period 2011-2016, which is approximately 990 in the data provided by Advisen.
  - Extreme scenario: frequency of attacks equal to twice the peak observed in 2013 (1373 events), resulting in 2746 attacks.
  - Expected aggregate losses: E[Z] = E[N] × E[X] = λ E[X].
- Distribution of losses:
  - Average losses are around USD 66 million in dataset, with a median at USD 4.7 million.
  - Most losses are below USD 200 million, with an outlier at around $4,010 million.
  - Losses modeled with a spliced distribution:
    - Bulk (x ≤ u): X ~ LN(μ, σ) with density f(x) = 1 / (x √(2π σ^2)) exp( − (ln(x) − μ)^2 / (2 σ^2) ).
    - Tail (x > u): X ~ GPD(ξ, α, β) with density f(x) = 1 / β (1 + ξ (x − α) / β)^(−1/ξ − 1).
  - Rationale: lognormal for the body and Generalized Pareto Distribution (GPD) for the tail to capture fat tails.

*Source: wp18143 - Box 1: DDoS attacks on multiple financial institutions*

### 4.0 billion in 2014 (RSA (2014)) in 2017-dollar terms. Fraudsters collected credentials from victims which were

### Aggregate losses from cyber-attacks (wp18143)

### Data and methodology
- Loss dataset: spliced distribution with parameters (휇,휎,휉,훼,훽,푢) estimated by maximum likelihood using the evmix package in R (Hu and Scarrott (2017)).
- Estimated threshold 푢 = $119 million, implying:
  - losses below $119 million follow a lognormal distribution
  - losses above $119 million follow a GPD
- Monte Carlo simulation approach for aggregate losses (10,000 simulations described; alternative simulations tested up to 1 million):
  - Algorithm (independence case):
    1. for 푘=1,...,퐾
       a. Simulate the number of events 푁 from the Poisson distribution
       b. Simulate independent severities 푋1, ..., 푋푁 from the severity distribution
       c. Calculate 푍푘 = ∑푖=1^푁 푋푖
    2. next 푘 = 푘 + 1
- Risk metrics computed from aggregate distribution of Z:
  - Value-at-Risk: 푉푎푅(푞) = 퐹⁻¹(푞)
  - Expected Shortfall: 퐸푆(푞) = 1/(1−푞) ∫_{푞}^{1} 퐹⁻¹(ℓ) dℓ  or equivalently 퐸(푍|푍>푉푎푅(푞))

### Contagion modeling
- Contagion introduced so each cyber-attack can affect one or several firms (Lindskog and McNeil (2003)); alternative dependence methods (e.g., copulas) noted but not used.
- For a given event, probability of having multiple losses follows a geometric distribution with parameter 푝 = 0.8 (i.e., 20 percent probability that each attack impacts several firms).
- Expected aggregate losses with contagion:
  - Let G = total number of loss events = N + M (initial losses N plus contagion losses M)
  - 퐸[퐺] = 퐸[푁] + 퐸[푁] × 퐸[푀]
  - Under Poisson-geometric assumptions: 퐸[퐺] = 휆 + 휆×(1−푝)/푝
  - For 푝 = 0.8: 퐸[퐺] = 1.25 × 휆 and 퐸[푍] = 1.25 × 휆 × 퐸[푋]
  - Implication: average losses are 25 percent higher when contagion is introduced
- Contagion simulation algorithm:
  1. for 푘=1,...,퐾
     a. Simulate 푁 from Poisson
     b. Simulate number of losses M related to N from Geometric distribution to get G = M + N
     c. Simulate independent severities X1,...,XG from severity distribution
     d. Calculate Zk = ∑_{i=1}^{G} Xi
  2. next k = k + 1
- Conditional contagion example: probability of contagion could increase from 20 percent to 60 percent if losses exceed the 90th percentile (tail-dependent contagion for large losses).

### Results — baseline, severe, and contagion-adjusted outcomes
- Baseline case (countries in ORX sample):
  - Average losses: USD 97 billion or 9 percent of banks net income (net income data from 2016 for sample of 7,947 banks)
  - VaR and ES:
    - VaR (95%): USD 147 billion (14 percent of net income)
    - VaR (99%): USD 201 billion (19 percent of net income)
    - ES (95%): USD 187 billion (18 percent of net income)
    - ES (99%): USD 281 billion (27 percent of net income)
  - Commentary: estimates far above publicly reported losses but a fraction of operational risk losses for banks (USD 260 billion in 2007 and 375 billion in 2009)
- Severe scenario (frequency of events twice the peak observed in 2013):
  - Average losses: USD 268 billion (26 percent of net income)
  - VaR and ES ranges:
    - VaR (95%): USD 352 billion (34 percent of net income)
    - VaR (99%): USD 539 billion (52 percent of net income)
    - ES (95%): USD 409 billion (40 percent of net income)
    - ES (99%): USD 539 billion (52 percent of net income)
- Contagion effects:
  - Introduction of contagion across financial institutions increases aggregate losses by around 20 percent (consistent with modelling assumptions)
  - Table 5 (excerpted figures) — Independence vs. Assuming 20% dependence:
    - Baseline Independence:
      - Average: 9% net income, USD 97 bn
      - VaR (95%): 14% net income, USD 147 bn
      - ES (95%): 18% net income, USD 187 bn
      - VaR 99%: 19% net income, USD 201 bn
      - ES (99%): 27% net income, USD 281 bn
    - Scenario 2 (severe) Independence:
      - Average: 26% net income, USD 268 bn
      - VaR (95%): 34% net income, USD 352 bn
      - ES (95%): 40% net income, USD 409 bn
      - VaR 99%: 41% net income, USD 427 bn
      - ES (99%): 52% net income, USD 539 bn
    - Baseline Assuming 20% dependence*:
      - Average: 12% net income, USD 127 bn
      - VaR (95%): 18% net income, USD 184 bn
      - ES (95%): 22% net income, USD 229 bn
      - VaR 99%: 24% net income, USD 248 bn
      - ES (99%): 32% net income, USD 329 bn
    - Scenario 2 (severe) Assuming 20% dependence*:
      - Average: 34% net income, USD 351 bn
      - VaR (95%): 43% net income, USD 446 bn
      - ES (95%): 49% net income, USD 509 bn
      - VaR 99%: 51% net income, USD 529 bn
      - ES (99%): 62% net income, USD 642 bn
    - *It is assumed that each cyber attack has a 20% probability to affect two or more firms.
- Comparison with other studies:
  - Symantec (2013): USD 113 billion annual cost of cybercrime
  - Anderson et al. (2013): USD 215 billion (direct and indirect losses, 2007-2012 data)
  - McAffee (2014): global costs between USD 375 and 575 billion
- Cyber insurance market context:
  - Cyber insurance premium market size: around USD 3 billion in premium globally in 2017
  - Expected to reach USD 12 to 20 billion in the next decade (Fitch Ratings (2017))
  - Take-up rates of less than 30 percent across sectors; average coverage limit purchased in 2016 around USD 3 million (CIAB (2016))

### Robustness and sensitivity analysis
- Number of simulations (independence case) — aggregated losses (USD billion):
  - 10,000 simulations: Average 97; Median 92; VaR (95%) 147; VaR (99%) 201; ES (95%) 187; ES (99%) 281
  - 100,000 simulations: Average 102; Median 96; VaR (95%) 152; VaR (99%) 204; ES (95%) 190; ES (99%) 277
  - 1 million simulations: Average 101; Median 96; VaR (95%) 151; VaR (99%) 202; ES (95%) 190; ES (99%) 276
- Alternative distributions for the bulk (baseline case, USD billion):
  - Lognormal GPD:
    - Average 97; Median 92; VaR (95%) 147; VaR (99%) 201; ES (95%) 187; ES (99%) 281
  - Normal GPD:
    - Average 114; Median 112; VaR (95%) 146; VaR (99%) 163; ES (95%) 157; ES (99%) 173
  - Gamma GPD:
    - Average 90; Median 87; VaR (95%) 129; VaR (99%) 159; ES (95%) 150; ES (99%) 191
- Reported distribution parameters (as provided):
  - Tail threshold: 0.12 (Lognormal GPD), 0.03 (Normal GPD), 0.08 (Gamma GPD)
  - Bulk distribution parameters:
    - Lognormal: Average 휇 = 1.72; Standard deviation σ = 1.89
    - Normal: Average 휇 = 12.6; Standard deviation σ = 15.7
    - Gamma: Average 휇 = 0.46 (shape); Standard deviation σ = 45.6 (scale)
  - GPD parameters:
    - Shape 휉: 0.45 (Lognormal GPD), 0.24 (Normal GPD), 0.39 (Gamma GPD)
    - Scale 훽: 857 (Lognormal GPD), 852 (Normal GPD), 838 (Gamma GPD)
    - Threshold 훼: 0.05 (Lognormal GPD), 0.09 (Normal GPD), 0.05 (Gamma GPD)
- Sensitivity to distributional choice: using a pure lognormal (no splice) yields average losses USD 38 billion; VaR (95%) USD 51 billion; ES (95%) USD 60 billion.

### Policy implications and recommendations
- Data and measurement:
  - Need for more granular and complete loss and frequency data, disaggregated by type of cyber-attack (data breach, fraud, business disruptions).
  - A consistent framework to collect data on cyber risk could mitigate sample bias (current data partial and biased towards certain countries).
  - Bayesian methods suggested as a possible way to mitigate uncertainty regarding cyber losses (Makov (2005)).
- Supervisory and regulatory actions:
  - Update regulatory and supervisory frameworks to account for cyber risk.
  - Develop capacity to assess key vulnerabilities in financial institutions and FMIs.
- Contingency planning and public intervention:
  - Public intervention options include designing contingency plans for large-scale attacks.
  - Stress-testing scenarios for business disruption of systemic participants and coordinated attacks on multiple banks recommended.
- Insurance market implications:
  - Current cyber insurance coverage is small relative to estimated aggregate losses; pricing and coverage remain challenging due to correlated exposures and uncertainty.

*Source: IMF Working Paper wp18143 (staff calculations, ORX News, SNL).*

---


_Source: https://www.imf.org/-/media/files/publications/wp/2018/wp18143.pdf_