Bad actors seeking to overwhelm organizations’ networks through distributed denial-of-service (DDoS) attacks have put the financial industry in their crosshairs.
Research from the Financial Services Information Sharing and Analysis Center (FS-ISAC) and cybersecurity firm Akamai found that DDoS attacks increased exponentially from 2014 to 2024, peaking in October with 350 recorded events. Due to the nature of these attacks, each incident involved thousands—or even millions—of malicious activities.
The financial industry was by far the most targeted sector in the study, and the frequency of DDoS attacks against it continues to rise. While these attacks often focus on organizations’ websites, there were also frequent DDoS attacks on APIs that facilitate aspects like logins and payments.
Multi-Dimensional Assaults
APIs are the connections that power modern banking infrastructure, allowing banks to work with partners to provide services ranging from credit scoring to peer-to-peer payments.
While these solutions have been game-changing for many financial institutions, the study also noted that the rapid adoption of APIs in financial services has expanded the potential attack surface for bad actors.
In many cases, DDoS attacks are mere nuisances that are easily defeated by financial institutions’ defenses. However, the most alarming finding in the study was not just the growing frequency of these attacks, but their increasing effectiveness.
“DDoS attacks are becoming increasingly sophisticated, evolving from simple network flooding to targeted, multi-dimensional assaults that exploit intricate vulnerabilities across the entire supply chain,” said Teresa Walsh, FS-ISAC’s Chief Intelligence Officer and Managing Director, EMEA, in a prepared statement.
Outsourcing the Operation
Even though these attacks are becoming more complex, that doesn’t mean there are barriers to entry for bad actors. Overall, DDoS usage is increasing. This not only makes it easier for cybercriminals to outsource their operations, but it also makes it difficult to identify the perpetrators.
DDoS is a subset of the growing cybercrime-as-a-service model, where criminals provide illicit software or services to individuals or groups for financial gain. As these services offer sophistication at a wider scale, financial institutions will have to continually find new ways to defend themselves.
