De Nederlandsche Bank (DNB) is “worried about hacks” on pension funds and other financial institutions, its economist, Maurice Doll, has said.

In its latest article on a series published on geopolitical risks, the Dutch regulator said the “threat of a cyber-attack on the financial sector is constant”.

DNB described digitisation as a “gift” for criminals and cautioned that hackers can break into financial institutions via a diversion if they cannot succeed via the institution itself.

For example, via their telecom provider, the data centre, or the laptop of the technician performing maintenance on a network. Indeed, in its latest Financial Stability Overview (OFS) DNB warned of dependence on a small group of service providers that provide crucial software, DNB policy adviser, Malou Dirks, said.

Furthermore, DNB noted how hackers are having their work made easier as there are organisations that sell ready-made software packages or digital vulnerabilities. These can then be used by criminals to infiltrate an institution.

“The most important thing is to know where the holes in the system are, and that is where a new piece of European financial legislation with a very cuddly name comes in: DORA. That is the abbreviation for the Digital Operational Resilience Act. It comes into force next January and requires banks, insurers and pension funds, among others, to carefully monitor how they organise their own cyber security and how their IT service providers manage it,” DNB said.

The regulator explained that under DORA major financial institutions will be required to undergo periodic hacking. Not by criminals, but by so-called 'ethical hackers', professionals who understand the criminal's business but who also operate on the right side of the law.

“The aim is to see how well these institutions are resistant to hacks by malicious entities. In the Netherlands, this was already done at the initiative of DNB, but with DORA it will become standing practice across Europe. DORA also requires institutions to take measures to recover quickly after cyber incidents,” DNB said.

---