Cybersecurity in financial services this week

Week ending 20 October 2026 · 44 sources

G7 to war-game AI cyberattacks on banks as Korean breaches spread

The Bank of England warned banks to prepare for AI-enabled cyber breaches, and G7 economies plan simulated AI attacks on banks 12. In South Korea, AI-driven attacks hit 16 financial firms and exposed 100,000 records 3.

Which way the market is moving

Supervisors put AI-enabled cyber risk to the test

The Bank of England and IMF warned of a cyber threat to trust in the financial system, and G7 economies plan simulated AI attacks on banks 112.

The Bank of England warned banks to prepare for AI-enabled cyber breaches 112. Bank of England and IMF leaders warned that cyber threats could undermine trust in the financial system 1113. G7 economies plan simulated AI attacks on banks to test how ready they are 21415.

In New Zealand, the RBNZ and FMA outlined supervisory expectations on cyber risks linked to frontier AI 4. US and European regulators are stepping up scrutiny of AI safeguards, Chinese models and cybersecurity, according to a report 16. The IMF and World Bank Group unveiled the Bangkok Blueprint, a framework against cyber fraud 17.

What it means: Supervisors are likely to ask for evidence that incident response and recovery plans hold up against AI-enabled attacks, not only that policies exist. Exercises built on AI-driven scenarios may become a routine supervisory request for any regulated institution.

Questions for vendors:

  1. Can your platform support tabletop or simulated attack exercises built on AI-enabled attack scenarios?
  2. How do you map your controls to supervisory expectations on frontier AI cyber risk, such as those set by the RBNZ and FMA?
  3. What evidence and logs can you produce for a regulator after an exercise or a live incident?

In the registry: RadiantOne Platform (Radiant Logic), Employee Information Security (Ncontracts), Cybersecurity Solutions (ITS (International Turnkey Systems))

South Korea's AI-driven breach wave widens

AI-driven cyberattacks hit 16 South Korean financial firms and exposed 100,000 records 3.

South Korea's financial regulator said personal information is presumed to have leaked from 16 financial institutions 18. The Korea Times reported that the AI-driven attacks exposed 100,000 records 3. Startup Fortune reported that regulators confirmed an AI agent breached 16 banks and lenders 19.

The Financial Services Commission ordered bank-wide checks after the attacks 20. Chief executives of major banks were questioned at a National Assembly audit over AI cyberattacks 2122. Korean banks plan to increase security spending after the breaches 23.

What it means: An AI agent probing web-facing systems at scale can turn ordinary weaknesses into a sector-wide event. Institutions should assume every customer-facing form and API can be tested quickly and check whether their detection would notice.

Questions for vendors:

  1. How does your web application and API protection detect automated, AI-driven probing that resembles normal customer traffic?
  2. How quickly can you show which customer data a given exposed application can reach?
  3. What evidence can you give that your testing covers loan, onboarding and other customer application pages?

In the registry: Developer Assist Agent (Checkmarx), Zscaler Private Access (ZPA) (Zscaler), Varonis MDDR (Varonis)

Deepfakes and app tampering press on identity

World launched an identity suite for banks and made its Zoom deepfake check generally available, as a new Android trojan replaces banking apps 824.

World, the digital identity project co-founded by Sam Altman, unveiled tools to help banks prevent deepfake fraud and AI-driven impersonation across customer accounts and employee workflows 7. Its Zoom deepfake check is now generally available 8, and banks are adding its badge to calls 25. The Hacker News noted cloned voices now appear in payment fraud, help desk resets and access requests 26.

The Hirudo Android trojan replaces legitimate banking apps with patched versions built to bypass their security checks 2724. Spanish banks reported a 150% spike in fraud, and research says fraud from stolen devices has surged 28. The FBI warned that scammers are cloning candidates' voices ahead of the US midterms 29.

What it means: A familiar voice, a video call or a genuine-looking app can no longer stand as proof of identity on their own. Help desk resets, payment approvals and account changes need verification through a separate channel.

Questions for vendors:

  1. How does your mobile app protection detect a repackaged or patched copy of our app on a customer device?
  2. What false acceptance rate have you measured against current voice and video deepfakes, and who tested it?
  3. How do your verification checks apply to staff help desk resets, not only customer onboarding?

In the registry: RadiantOne Platform (Radiant Logic), Employee Information Security (Ncontracts), Cybersecurity Solutions (ITS (International Turnkey Systems))

Suppliers and edge devices remain the weak point

A stolen ConnectWise credential exposed Microsoft 365 tenants, and attackers chained three Ivanti VPN zero-days for root access 3031.

A stolen ConnectWise 'SkyKick' credential exposed Microsoft 365 tenants, and Cloud Backup was pulled worldwide as customers hunt for planted credentials valid until 2028 30. Attackers chained three Ivanti VPN zero-days for root access, and one flaw awaits a fix 31. CISA added exploited flaws in BeyondTrust, Fortinet, Cisco, Palo Alto Networks, Ivanti, Ahsay and Microsoft products to its catalogue this week F.

A cyber incident at contractor BAE Systems took down the notice system used by US federal bankruptcy courts 3233. In India, CERT-In warned on API vulnerabilities after cyberattacks affected 20 financial institutions 34. The ACSC issued an alert on risks to operational technology and edge devices 35.

What it means: Backup, remote support and VPN products hold privileged access, so a breach at the supplier quickly becomes a breach at the institution. Third-party reviews should test how fast a supplier can revoke and rotate the credentials it holds.

Questions for vendors:

  1. What credentials or tokens do you hold for our tenant, how long are they valid, and how would you revoke them after a breach?
  2. What is your time to patch for actively exploited flaws, and how do you confirm a fix is complete?
  3. How will you notify us if your own environment is compromised?

In the registry: Developer Assist Agent (Checkmarx), RadiantOne Platform (Radiant Logic), WALLIX PAM (WALLIX)

Post-quantum guidance and vendor consolidation

The NCSC published post-quantum recommendations for TLS, while Proofpoint agreed to buy Varonis and IonQ agreed to buy Elisity 36910.

The NCSC published recommendations for configuring post-quantum cryptography in TLS and said now is the time to migrate 36. IonQ agreed to buy Elisity in an all-stock deal worth up to $1.3 billion to expand its quantum security platform 1037. IonQ shares slid after the announcement 38.

Proofpoint agreed to acquire Varonis in a $6.3bn deal 9. OpenAI is in early talks to acquire security firm Trail of Bits, according to market reports 39. Together the deals show buyers of email, data security and testing services may see suppliers change owners 939.

What it means: Post-quantum migration starts with knowing where TLS and keys sit across the estate, and suppliers should be asked for dated roadmaps now. Acquisitions can change product direction and pricing mid-contract, so change-of-control terms deserve a review.

Questions for vendors:

  1. Which of your products support post-quantum key exchange in TLS today, and when will the rest?
  2. If your company is acquired, what commitments apply to roadmap, support and pricing under existing contracts?
  3. Can you give us an inventory of the cryptographic libraries and algorithms your product uses?

In the registry: Digital forensics and incident response (Gridware), Varonis MDDR (Varonis), RadiantOne Platform (Radiant Logic)

Regulation and supervision

Sources

  1. Reuters, 2026-10-15: BoE warns banks to prepare for AI-enabled cyber breaches
  2. Financial Times, 2026-10-16: G7 economies plan simulated AI attacks on banks as cyber fears rise
  3. The Korea Times, 2026-10-14: AI-driven cyberattacks hit 16 financial firms, expose 100,000 records
  4. Finextra (security), 2026-10-15: New Zealand regulators set out cyber and AI risk expectations
  5. PYMNTS.com, 2026-10-15: Bank of America Deploys 4,000 Workers to Patch Vulnerabilities Found by Frontier AI
  6. The Hacker News, 2026-10-14: An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
  7. Finextra, 2026-10-19: World takes on AI-driven impersonations with new suite for banking and finance
  8. The Block, 2026-10-19: World launches World ID suite for banks, makes Zoom deepfake check generally available
  9. Yahoo Finance, 2026-10-16: Proofpoint to acquire Varonis in $6.3bn cybersecurity deal
  10. Yahoo Finance, 2026-10-12: IonQ Strikes up to $1.3 Billion Deal to Buy Cybersecurity Firm Elisity
  11. The Guardian, 2026-10-14: Bank of England and IMF bosses warn of cyber threat to trust in financial system
  12. PYMNTS.com, 2026-10-15: BoE Warns Banks Against AI Cybersecurity Risks
  13. Finextra Research, 2026-10-14: BoE and IMF warn of cyber threat to banking system
  14. International Business Times, Singapore Edition, 2026-10-18: G7 Plans AI Cyberattack Drills for Banks, Testing How Ready They Are for an Attack
  15. Insurance Business, 2026-10-16: G7 to war-game AI cyberattacks on banks as regulators sound systemic alarm
  16. Yahoo Finance, 2026-10-15: AI Agents Could Pose New Risks to Banks: US, European Regulators Step Up Scrutiny of AI Safeguards, Chinese Models and Cybersecurity: Report
  17. FinTech Global, 2026-10-19: Bangkok Blueprint sets global playbook against cyber fraud
  18. Korea JoongAng Daily, 2026-10-14: Personal info presumed to have leaked from 16 financial institutions: Regulator
  19. Startup Fortune, 2026-10-17: South Korean Regulators Confirm AI Agent Breached 16 Banks and Lenders
  20. FinTech Global, 2026-10-13: Korea’s FSC orders bank-wide checks after AI cyberattacks
  21. The Korea Times, 2026-10-19: CEOs of major banks grilled at Assembly audit over AI cyberattacks
  22. The Korea Herald, 2026-10-18: Top bank chiefs face grilling over cyberattacks
  23. The Korea Herald, 2026-10-16: Korean banks plan security spending increases after data breaches
  24. The Hacker News, 2026-10-14: Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
  25. Startup Fortune, 2026-10-19: Banks Add Sam Altman's World ID Badge to Calls to Spot Deepfakes
  26. The Hacker News, 2026-10-14: How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
  27. BleepingComputer, 2026-10-14: Hirudo Android malware replaces banking apps to evade security checks
  28. Finextra (payments), 2026-10-14: Spanish banks report 150% spike in fraud
  29. Help Net Security, 2026-10-16: Scammers clone candidates’ voices to steal cash and voter data ahead of 2026 midterms, FBI warns
  30. iTnews, 2026-10-18: Stolen ConnectWise 'SkyKick' credential exposed Microsoft 365 tenants
  31. iTnews, 2026-10-13: Attackers chain three Ivanti VPN zero-days for root access
  32. BleepingComputer, 2026-10-16: BAE Systems cyberattack disrupts US federal court operations
  33. Infosecurity Magazine, 2026-10-16: Cyber Incident at BAE Systems Disrupts US Federal Bankruptcy Noticing
  34. The Economic Times, 2026-10-14: Cyberattacks affect 20 financial institutions; CERT-In warns on API vulnerabilities and security measures
  35. ASD's ACSC (alerts), 2026-10-14: Protecting operational technology and edge devices
  36. NCSC, 2026-10-15: Post-quantum updates to our TLS guidance
  37. Yahoo Finance UK, 2026-10-12: IonQ expands quantum security platform via $1.3B acquisition of Elisity
  38. Yahoo Finance, 2026-10-12: IonQ Shares Slide After Firm Announces $1.3B All-Stock Deal To Acquire Cybersecurity Firm Elisity
  39. Yahoo Finance, 2026-10-14: Market Chatter: OpenAI in Early Talks to Acquire Cybersecurity Firm Trail of Bits
  40. Krebs on Security, 2026-10-14: U.K. Sanctions Cryptomus for RU Money Laundering
  41. BusinessDesk | NZ, 2026-10-14: Banks withstand oil shock, recession and cyber attack in stress test
  42. Banking Dive, 2026-10-16: NYDFS fines Swedish bank SEB $33M over AML issues
  43. FinTech Global, 2026-10-19: CRA reporting clock is already ticking for EU manufacturers
  44. CyberScoop, 2026-10-16: Cybersecurity incident at BAE Systems disrupts US bankruptcy court system

About cybersecurity software

Cybersecurity vendors protect an institution's systems and data: identity and access, threat detection, security operations and data protection.

Browse the products in the registry

Previous weeks

Get the market overview every Monday: subscribe to the Vederca newsletter.