{
  "title": "Estimating Cyber Risk for the Financial Sector",
  "publication": "IMF Blog, June 22, 2018",
  "sourceUrl": "https://www.imf.org/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector",
  "canonical": "https://www.imf.org/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector",
  "overlayPath": "/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector/index.md",
  "summary": "Author: Christine Lagarde",
  "sections": [
    {
      "heading": "Cyber risk overview",
      "content": "- Author: Christine Lagarde\n- Date: June 22, 2018\n- Summary finding: Cyber risk has emerged as a significant threat to the financial system; an IMF staff modeling exercise estimates that average annual losses to financial institutions from cyber-attacks could reach a few hundred billion dollars a year, eroding bank profits and potentially threatening financial stability.\n- Recent examples cited:\n  - Data breaches exposing confidential information.\n  - Fraud, such as the theft of $500 million from the Coincheck cryptocurrency exchange.\n  - Risk that a targeted institution could be left unable to operate."
    },
    {
      "heading": "Financial sector’s vulnerability",
      "content": "- Reasons for heightened vulnerability:\n  - Financial institutions’ crucial role in intermediating funds makes them attractive targets.\n  - High interconnectedness means a successful attack on one institution could spread rapidly.\n  - Many institutions still use older systems that might not be resilient to cyber-attacks.\n  - Successful cyber-attacks cause direct financial losses and indirect costs such as diminished reputation.\n- Observations:\n  - Surveys consistently show risk managers and executives at financial institutions worry most about cyber-attacks.\n  - Quantitative analysis of cyber risk is still at an early stage due to lack of data and modeling difficulties."
    },
    {
      "heading": "Estimating potential losses (modeling framework and results)",
      "content": "- Methodology:\n  - Uses techniques from actuarial science and operational risk measurement to estimate aggregate losses from cyber-attacks.\n  - Requires assessment of frequency of cyber-attacks on financial institutions and distribution of losses from such events.\n  - Numerical simulations used to estimate distribution of aggregate cyber-attack losses.\n- Data example:\n  - Illustration uses a data set covering recent losses due to cyber-attacks in 50 countries.\n  - The exercise is difficult and challenged by major data gaps on cyber risk.\n- Key quantitative findings (reported as illustrative):\n  - Average annual potential losses from cyber-attacks may be large, close to 9 percent of banks’ net income globally, or around $100 billion.\n  - In a severe scenario — in which the frequency of cyber-attacks would be twice as high as in the past with greater contagion — losses could be 2½–3½ times as high as this, or $270 billion to $350 billion.\n  - Distributional insight: in extreme scenarios representing the worst 5 percent of cases, average potential losses could reach as high as half of banks’ net income, putting the financial sector at risk.\n  - Note: Thankfully, there has yet been no successful, large-scale cyber-attack on the financial system."
    },
    {
      "heading": "Insurance market and gaps",
      "content": "- Current market size and limitations:\n  - Cyber insurance market remains small with around $3 billion in premiums globally in 2017.\n  - Most financial institutions do not carry cyber insurance.\n  - Coverage is limited.\n- Insurer challenges:\n  - Difficulty evaluating risk because of uncertainty about cyber exposures, lack of data, and possible contagion effects.\n- Comparative note:\n  - Estimated potential losses are several orders of magnitude greater than the present size of the cyber insurance market."
    },
    {
      "heading": "The way forward (policy recommendations and operational steps)",
      "content": "- Data and reporting:\n  - Government collection of more granular, consistent, and complete data on frequency and impact of cyber-attacks would help assess risk for the financial sector.\n  - Requirements to report breaches—such as considered under the EU’s General Data Protection Regulation—should improve knowledge of cyber-attacks.\n- Analytical tools:\n  - Use scenario analysis to develop comprehensive assessment of how cyber-attacks could spread and to design adequate responses by private institutions and governments.\n- Resilience and capacity building:\n  - Further work needed to understand how to strengthen resilience of financial institutions and infrastructures to reduce odds of successful attacks and facilitate rapid recovery.\n  - Need to build capacity in the official sector in many parts of the world to monitor and regulate such risks.\n- Regulatory and supervisory priorities:\n  - Strengthen regulatory and supervisory frameworks for cyber risk.\n  - Focus on effective supervisory practices, realistic vulnerability and recovery testing, and contingency planning.\n  - IMF is providing technical assistance to help member countries improve their regulatory and supervisory frameworks.\n\nEstimating Cyber Risk for the Financial Sector — Christine Lagarde, June 22, 2018\n\n---\n\n Content in this bundle\n\n- 估计金融部门的网络风险; IMF blog, 2018 年6 月22 日\n  - 估计金融部门的网络风险; IMF blog, 2018 年6 月22 日 (Markdown version){rel=\"alternate\" type=\"text/markdown\"}\n  - 估计金融部门的网络风险; IMF blog, 2018 年6 月22 日 (PDF){rel=\"external\" type=\"application/pdf\"}\n- 金融セクターのサイバーリスクを試算する;   クリスティーヌ・ラガルド, IMF ブログ 2018年6月22日掲載\n  - 金融セクターのサイバーリスクを試算する;   クリスティーヌ・ラガルド, IMF ブログ 2018年6月22日掲載 (Markdown version){rel=\"alternate\" type=\"text/markdown\"}\n  - 金融セクターのサイバーリスクを試算する;   クリスティーヌ・ラガルド, IMF ブログ 2018年6月22日掲載 (PDF){rel=\"external\" type=\"application/pdf\"}\n- Memprakirakan Risiko Cyber untuk Sektor Keuangan; IMF blog; 22 Juni 2018\n  - Memprakirakan Risiko Cyber untuk Sektor Keuangan; IMF blog; 22 Juni 2018 (Markdown version){rel=\"alternate\" type=\"text/markdown\"}\n  - Memprakirakan Risiko Cyber untuk Sektor Keuangan; IMF blog; 22 Juni 2018 (PDF){rel=\"external\" type=\"application/pdf\"}\n- Оценка кибер-риска для финансового сектора; Кристин Лагард; Блог МВФ;  22 июня 2018 года\n  - Оценка кибер-риска для финансового сектора; Кристин Лагард; Блог МВФ;  22 июня 2018 года (Markdown version){rel=\"alternate\" type=\"text/markdown\"}\n  - Оценка кибер-риска для финансового сектора; Кристин Лагард; Блог МВФ;  22 июня 2018 года (PDF){rel=\"external\" type=\"application/pdf\"}\n\n---\n\n References\n\n- عربي\n- Português\n- https://www.imf.org/wp-content/uploads/2018/06/BLOG-1024x600-cyber-security-EtiAmmos-gettyimages-iStock-854938338.jpg\n- https://www.imf.org/wp-content/uploads/2018/06/eng-june-19-cyber-losses1-1-1.png\n- international organizations\n- https://www.imf.org/wp-content/uploads/2018/06/eng-june-19-cyberlosses2.png\n\nSource: https://www.imf.org/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector"
    }
  ],
  "bullets": [
    "[Markdown version](/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector/index.md)",
    "[Structured JSON version](/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector/index.json)",
    "[Bundle manifest](/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector/bundle-manifest.json)",
    "Authors: Christine Lagarde",
    "Published: June 22, 2018",
    "Author: Christine Lagarde",
    "Date: June 22, 2018",
    "Summary finding: Cyber risk has emerged as a significant threat to the financial system; an IMF staff modeling exercise estimates that average annual losses to financial institutions from cyber-attacks could reach a few hundred billion dollars a year, eroding bank profits and potentially threatening financial stability.",
    "Recent examples cited:",
    "Reasons for heightened vulnerability:",
    "Observations:",
    "Methodology:",
    "Data example:",
    "Key quantitative findings (reported as illustrative):",
    "Current market size and limitations:",
    "Insurer challenges:",
    "Comparative note:",
    "Data and reporting:",
    "Analytical tools:",
    "Resilience and capacity building:",
    "Regulatory and supervisory priorities:",
    "**估计金融部门的网络风险; IMF blog, 2018 年6 月22 日**",
    "**金融セクターのサイバーリスクを試算する;   クリスティーヌ・ラガルド, IMF ブログ 2018年6月22日掲載**",
    "**Memprakirakan Risiko Cyber untuk Sektor Keuangan; IMF blog; 22 Juni 2018**",
    "**Оценка кибер-риска для финансового сектора; Кристин Лагард; Блог МВФ;  22 июня 2018 года**",
    "[عربي](http://www.imf.org/ar/News/Articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector)",
    "[Português](https://www.imf.org/pt/News/Articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector)",
    "[https://www.imf.org/wp-content/uploads/2018/06/BLOG-1024x600-cyber-security-EtiAmmos-gettyimages-iStock-854938338.jpg](https://www.imf.org/wp-content/uploads/2018/06/BLOG-1024x600-cyber-security-EtiAmmos-gettyimages-iStock-854938338.jpg)",
    "[https://www.imf.org/wp-content/uploads/2018/06/eng-june-19-cyber-losses1-1-1.png](https://www.imf.org/wp-content/uploads/2018/06/eng-june-19-cyber-losses1-1-1.png)",
    "[international organizations](https://blogs.imf.org/2017/10/26/cyber-defense-must-be-global/)",
    "[https://www.imf.org/wp-content/uploads/2018/06/eng-june-19-cyberlosses2.png](https://www.imf.org/wp-content/uploads/2018/06/eng-june-19-cyberlosses2.png)"
  ],
  "related": [
    {
      "title": "估计金融部门的网络风险; IMF blog, 2018 年6 月22 日",
      "role": "document",
      "sourceUrl": "http://www.imf.org/external/chinese/np/blog/2018/062218c.pdf",
      "summary": {
        "path": "/external/chinese/np/blog/2018/062218c.pdf.md",
        "mime": "text/markdown"
      },
      "binary": {
        "path": "/external/chinese/np/blog/2018/062218c.pdf",
        "mime": "application/pdf"
      }
    },
    {
      "title": "金融セクターのサイバーリスクを試算する;   クリスティーヌ・ラガルド, IMF ブログ 2018年6月22日掲載",
      "role": "document",
      "sourceUrl": "http://www.imf.org/external/japanese/np/blog/2018/062218j.pdf",
      "summary": {
        "path": "/external/japanese/np/blog/2018/062218j.pdf.md",
        "mime": "text/markdown"
      },
      "binary": {
        "path": "/external/japanese/np/blog/2018/062218j.pdf",
        "mime": "application/pdf"
      }
    },
    {
      "title": "Memprakirakan Risiko Cyber untuk Sektor Keuangan; IMF blog; 22 Juni 2018",
      "role": "document",
      "sourceUrl": "http://www.imf.org/external/lang/indonesian/np/blog/2018/062218i.pdf",
      "summary": {
        "path": "/external/lang/indonesian/np/blog/2018/062218i.pdf.md",
        "mime": "text/markdown"
      },
      "binary": {
        "path": "/external/lang/indonesian/np/blog/2018/062218i.pdf",
        "mime": "application/pdf"
      }
    },
    {
      "title": "Оценка кибер-риска для финансового сектора; Кристин Лагард; Блог МВФ;  22 июня 2018 года",
      "role": "document",
      "sourceUrl": "http://www.imf.org/external/russian/np/blog/2018/062218r.pdf",
      "summary": {
        "path": "/external/russian/np/blog/2018/062218r.pdf.md",
        "mime": "text/markdown"
      },
      "binary": {
        "path": "/external/russian/np/blog/2018/062218r.pdf",
        "mime": "application/pdf"
      }
    }
  ],
  "alternates": {
    "markdown": "/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector/index.md",
    "json": "/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector/index.json",
    "bundleManifest": "/en/blogs/articles/2018/06/22/blog-estimating-cyber-risk-for-the-financial-sector/bundle-manifest.json"
  },
  "generatedAtUtc": "2026-08-28T22:21:11.778Z"
}