Financial Services Cybersecurity Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen, Cybersecurity | Last updated: September 4, 2026 | License: CC BY 4.0
EU financial entities reported 3,383 major ICT incidents in 2025, the first full year of mandatory reporting under DORA. Only 10% were cybersecurity incidents. 29% were caused by a third-party supplier. According to Axis Intelligence Research, a European bank was 2.9 times more likely to suffer a major incident from a vendor failure than from an attacker.
Quick Answer
The European Supervisory Authorities logged 3,383 major ICT-related incidents across EU financial entities in 2025, an average of 0.18 per regulated firm. System failures caused half of them; cybersecurity incidents accounted for 10%. The average financial services data breach cost $6.3 million in IBM’s 2026 study, against a $4.99 million global average. According to Axis Intelligence Research, the Axis Financial Cyber Tail Ratio (FCTR) reached 107.8 for 2021, meaning the median worst-case annual cyber loss at a financial firm has moved from roughly a third of the all-industry benchmark in 2017 to slightly above it.
Key Findings
- According to Axis Intelligence Research, the Third-Party Incidence Ratio (TPI) for the EU financial sector stands at 2.9 for 2025: 29% of major ICT incidents originated in a third-party provider failure, against 10% classified as cybersecurity incidents.
- According to Axis Intelligence Research, the Financial Cyber Tail Ratio (FCTR) rose from 36.2 in 2017 to 107.8 in 2021 at the median, and from 53.2 to 90.2 at the 90th percentile, as financial firms’ modelled extreme cyber losses converged on the all-industry benchmark.
- According to Axis Intelligence Research, financial services breaches carried a 126.3 cost premium over the global all-industry average in IBM’s 2026 study, computed as $6.3 million divided by $4.99 million.
- According to Axis Intelligence Research, the ESAs’ own reporting implies a DORA-covered population of roughly 18,800 financial entities, derived from 3,383 major incidents at a stated 0.18 incidents per entity.
- According to Axis Intelligence Research, US financial services recorded 739 data compromises in 2025 and 387 in the first half of 2026, the highest of any sector in both periods, while its share of all US compromises fell slightly from 22.25% to 21.46%.
How Many Cyber Incidents Does the Financial Sector Actually Report?
For twenty years this question had no clean answer. Incident counts came from voluntary surveys, insurance claims databases, or breach-notification laws that only fire when consumer data leaves the building. In 2025 that changed in one jurisdiction, and the resulting dataset is the most complete public accounting of financial-sector operational incidents anyone has published.
Under Article 19 of the Digital Operational Resilience Act, every EU financial entity must notify its competent authority of any major ICT-related incident. The clock is tight: an initial notification within four hours of classifying the incident as major and no later than 24 hours from becoming aware of it, an intermediate report within 72 hours, and a final report within one month. Article 22 then obliges the three European Supervisory Authorities to publish an annual aggregate. The first such report, covering calendar 2025, was published on June 3, 2026.
It counted 3,383 major incidents, an average of 282 per month.
Major ICT incidents in the EU financial sector, 2025
| Measure | Value | Source |
|---|---|---|
| Total major incidents reported | 3,383 | ESAs, JC 2026 16 |
| Average per month | 282 | ESAs, JC 2026 16 |
| Average per financial entity subject to DORA | 0.18 | ESAs, JC 2026 16 |
| Credit sector share of all major incidents | more than 60% | ESAs, JC 2026 16 |
| Credit sector incidents per entity | 0.57 | ESAs, JC 2026 16 |
| Payments sector share | 16% | ESAs, JC 2026 16 |
| Payments sector incidents per entity | 0.23 | ESAs, JC 2026 16 |
| Incidents with cross-border impact | 1,056 (31.2%) | ESAs, JC 2026 16 |
| Incidents affecting more than 10 member states | about 8% | ESAs, JC 2026 16 |
| Incidents with no final report by the Feb 5, 2026 cutoff | about 15%, excluded | ESAs, JC 2026 16 |
Two derived figures matter here. According to Axis Intelligence Research, dividing 3,383 incidents by the stated rate of 0.18 per entity implies a DORA-covered population of roughly 18,800 financial entities across the EU, a denominator the ESAs report does not state directly. Because 0.18 is published to two decimal places, the honest range runs from about 18,300 to 19,300. And credit institutions reported 2.48 times as many major incidents per entity as payment institutions (0.57 against 0.23), which is a market-structure fact rather than a security one: the ESAs note that many small credit institutions in the same group share infrastructure, so a single failure at a shared supplier generates dozens of separate filings.
Marcus Chen, Cybersecurity: The number everyone will lift from this report is 3,383, and it is the least interesting number in it. A count of filings is a count of filing behaviour. What is genuinely new is the denominator and the cutoff discipline: the ESAs excluded roughly 15% of 2025 incidents because no final report had arrived by February 5, which means the real total is higher and they said so rather than padding the figure. Compare that with how incident counts are normally assembled in this sector and the difference is the entire argument for regulatory reporting over vendor telemetry.
Is the Financial Sector’s Cyber Problem Really an Attacker Problem?
This is where the ESAs data breaks the received wisdom, and it is the finding most likely to change how a bank allocates its operational risk budget.
Of 3,383 major incidents, system failures accounted for 51%, external events 27%, and payment-related incidents 18%. Cybersecurity incidents accounted for 10%, roughly 338 events across the entire EU financial system in a year. On the root-cause side, half of all major incidents traced to a system failure or malfunction, 32% to external events, 19% to process failures, and 12% to human error. And 29% of all major incidents originated in a failure on the side of a third-party provider.
The Third-Party Incidence Ratio (TPI)
What it measures: how much of a financial entity’s major-incident load comes from its supply chain compared with how much comes from a deliberate attacker, in a single reporting population.
Formula: TPI = (share of major incidents attributable to a third-party provider failure) ÷ (share of major incidents classified as cybersecurity incidents).
Worked inputs, EU 2025: 29 ÷ 10 = 2.9.
Both inputs come from the same document, the same reporting population, and the same twelve-month window, which is what makes the ratio meaningful rather than decorative. According to Axis Intelligence Research, a European financial entity in 2025 was roughly three times more likely to suffer a major operational incident caused by a supplier than by an attacker.
That does not mean cyber risk is small. It means cyber risk is concentrated and rare while dependency risk is diffuse and constant, and the two demand different controls. The ESAs are explicit that the low cybersecurity share suggests existing safeguards were working, not that attackers went away.
What the cybersecurity incidents looked like
| Threat or technique | Share of cybersecurity incidents | Approximate count | Source |
|---|---|---|---|
| Distributed denial of service | 33% | about 112 | ESAs, JC 2026 16 |
| Data exfiltration and manipulation, including identity theft | 31% | about 105 | ESAs, JC 2026 16 |
| Ransomware | concentrated in insurance | not stated | ESAs, JC 2026 16 |
Counts are Axis Intelligence Research calculations applying the published shares to the 10% cybersecurity subset of 3,383 incidents. DDoS and exfiltration cluster heavily in the credit sector. Ransomware skews toward insurance, which the ESAs attribute to the volume of sensitive health and financial data insurers hold, a pattern consistent with what we track in deepfake fraud statistics on the identity-abuse side.
One supporting figure is worth keeping separate because it comes from a different instrument. The EBA’s Autumn 2025 Risk Assessment Questionnaire found that the share of responding banks that had faced at least one successful attack resulting in an actual major ICT incident fell to 28%, from 35% in the previous iteration, after a steady climb since 2023. That is a survey of banks, not a filing count, and the two should not be added together.
What Does a Financial Services Data Breach Cost in 2026?
IBM’s 2026 Cost of a Data Breach study, released July 29, 2026 and covering 602 organisations breached between March 2025 and February 2026, put the global average at a record $4.99 million. Financial services averaged $6.3 million. IBM named financial services and energy as the two most targeted sectors in the study and flagged the cascading-impact risk that concentration creates.
The financial services cost premium
According to Axis Intelligence Research, the sector premium computes as follows: $6.3 million ÷ $4.99 million × 100 = 126.3. In absolute terms the gap is $1.31 million per breach. Healthcare remained the costliest sector at $6.64 million; financial services sat second of the 17 industries studied.
One in four malicious breaches in the 2026 study was AI-enabled, a 56% increase year over year, and those breaches averaged about $6 million. The mean time to identify and contain a breach rose to 247 days, reversing five consecutive years of improvement.
A calculation we declined to publish
The obvious next move is to compute the same premium for 2025 and report the trend. Axis Intelligence Research attempted it and does not publish the result.
The problem is input consistency. IBM’s own 2026 release states the financial services figure as $6.3 million; readings of the report’s industry table render it as $6.29 million, and the prior-year financial services figure circulates as both $5.56 million and, by back-solving IBM’s stated 12% year-over-year change, roughly $5.62 million. A premium series built on inputs that differ by six figures in the denominator would produce a trend line whose direction depends on which secondary reading you picked. The 2026 premium of 126.3 is a dated snapshot, computed from two numbers in one primary release, and that is all we will claim for it. The refusal is recorded in the dataset as a retracted row.
Marcus Chen, Cybersecurity: There is a version of this article that says the sector premium is growing, because that is the story in the trade coverage. Run the arithmetic on the numbers actually available and you cannot support the claim to one decimal place. Financial services costs rose about 13% while the global average rose about 12%. That is a rounding difference between two survey means with 602 respondents between them, not a trend. If your board deck needs a sector benchmark, use 126 and the date, and stop there.
How Large Can a Single Financial-Sector Cyber Loss Get?
Averages are the wrong instrument for a risk whose distribution is this skewed. The IMF’s April 2024 Global Financial Stability Report is the only public work that fits an extreme-value distribution to firm-level cyber losses and reports the financial-sector case separately, drawing on more than 170,000 cyber events at approximately 90,000 companies.
Its headline sector findings: almost one-fifth of all reported cyber incidents over the past two decades affected financial firms, with banks facing about half of the sector’s incidents, followed by insurers and asset managers. Financial firms reported direct losses of almost $12 billion since 2004, of which $2.5 billion came after 2020, or 20.8% of the twenty-year total, compressed into the last four years of the window.
The tail estimates are where the sector story sits.
The Axis Financial Cyber Tail Ratio (FCTR)
What it measures: how a financial firm’s modelled worst-case annual cyber loss compares with the same estimate for firms in general, tracked across the two years the IMF reports.
Formula: FCTR = (estimated maximum annual cyber loss, financial firms ÷ estimated maximum annual cyber loss, all firms) × 100, computed separately at the median and at the 90th percentile of the fitted generalised extreme value distribution.
Worked example, median 2021: $152 million ÷ $141 million × 100 = 107.8.
| Estimate point | Year | Financial firms | All firms | FCTR |
|---|---|---|---|---|
| Median maximum annual loss | 2017 | $21m | $58m | 36.2 |
| Median maximum annual loss | 2021 | $152m | $141m | 107.8 |
| 90th percentile (roughly once a decade) | 2017 | $285m | $536m | 53.2 |
| 90th percentile | 2021 | $2,247m | $2,490m | 90.2 |
Source: Axis Intelligence Research calculation from IMF Global Financial Stability Report, April 2024, Chapter 3, Figure 3.5 panels 3 and 4. Loss figures are IMF estimates in millions of US dollars.
Two readings. First, at the median the financial sector crossed over: in 2017 a financial firm’s expected worst year was roughly a third as bad as the all-industry benchmark; by 2021 it was slightly worse. Second, the convergence is driven by speed rather than level. Financial-firm median tail losses grew 7.2-fold over the period while all-firm losses grew 2.4-fold, and at the 90th percentile 7.9-fold against 4.6-fold.
According to Axis Intelligence Research, this is the single most useful framing available for a bank’s cyber capital conversation: the sector no longer enjoys a tail-risk discount for its maturity. The IMF’s own once-a-decade estimate for a financial firm is $2.2 billion.
Marcus Chen, Cybersecurity: Read FCTR next to the concentration data in the same chapter and the mechanism is obvious. More than 50% of the IT providers serving global systemically important banks serve two or more of them. For insurers the figure is about 20% and for asset managers about 25%. A tail loss stops being idiosyncratic when the same four suppliers sit underneath every institution in the sample. That is also why the TPI ratio and the FCTR series are telling the same story from opposite ends: the supply chain is where routine incidents come from, and it is where the once-a-decade one will come from too.
Which Financial Institutions Report the Most Breaches in the United States?
US disclosure runs on a different instrument again. The Identity Theft Resource Center’s H1 2026 Data Breach Report, published July 22, 2026, tracked 1,803 data compromises in the first six months of 2026 against 3,321 for all of 2025.
Financial services led every sector in both periods: 739 compromises in calendar 2025 and 387 in the first half of 2026, ahead of healthcare’s 281.
| Period | Financial services compromises | All US compromises | Financial share |
|---|---|---|---|
| Calendar 2025 | 739 | 3,321 | 22.25% |
| H1 2026 | 387 | 1,803 | 21.46% |
Source: Axis Intelligence Research calculation from Identity Theft Resource Center 2025 Annual and H1 2026 Data Breach Reports.
According to Axis Intelligence Research, the sector’s share of all US compromises fell 0.79 percentage points between the two periods even as its absolute count tracked toward a higher annual total. Financial services is not gaining share of the US breach population; it is holding roughly a fifth of it while the population itself grows.
The ITRC’s transparency finding constrains everything downstream: only 24% of H1 2026 breach notices disclosed an attack vector, the lowest rate the organisation has recorded. Any US analysis of how financial institutions are being breached is working from a quarter of the evidence, which is precisely why the DORA dataset above carries so much weight. Our data breach tracker logs vectors incident by incident where they are disclosed, and the credential attack statistics dataset covers the identity side of the same events.
What Are the Cyber Incident Reporting Deadlines for Financial Institutions?
Three regimes now govern disclosure for most large financial institutions, and their clocks start at different moments. That divergence, rather than the deadlines themselves, is what breaks incident response plans.
| Regime | Trigger | Deadline | Source |
|---|---|---|---|
| DORA, Art. 19 (EU) | Classification of an incident as major | 4 hours, and no later than 24 hours from awareness | ESAs, JC 2026 16 |
| DORA intermediate report | Submission of initial notification | 72 hours | ESAs, JC 2026 16 |
| DORA final report | Completion of root cause analysis | 1 month after intermediate report | ESAs, JC 2026 16 |
| SEC Form 8-K, Item 1.05 (US) | Registrant’s determination that an incident is material | 4 business days | SEC |
| NYDFS 23 NYCRR 500.17(a) | Determination that a reportable event occurred | 72 hours | NYDFS |
| NYDFS ransomware payment notice | Payment made | 24 hours | NYDFS |
The SEC clock is the outlier and the one most often misread. As the SEC’s own compliance guide states, the four-business-day deadline for an Item 1.05 filing runs from the registrant’s determination that the incident is material, not from discovery. Materiality must be assessed without unreasonable delay, but the two events are distinct. A DORA notification can therefore be due in four hours while the SEC filing for the same event is still weeks away, and a firm regulated on both sides of the Atlantic has to run both procedures from a single incident timeline.
DORA itself came into force on January 16, 2023 and applied from January 17, 2025. Its scope is a live source discrepancy worth publishing rather than smoothing. ESMA’s DORA page states the regulation applies to 21 different types of financial entities, of which 12 sit in ESMA’s remit, while EIOPA’s equivalent page states 20. Both are European Supervisory Authorities describing the same regulation. Axis Intelligence Research reports both figures and does not reconcile them.
On the supervisory side, the ECB concluded its first cyber resilience stress test in July 2024, covering 109 directly supervised banks, of which 28 performed an actual IT recovery test with supervisors on site. The scenario assumed every preventive control had failed. In the United States, the final phase of the NYDFS Second Amendment took effect on November 1, 2025, extending multi-factor authentication to essentially all remote access including third-party applications, and requiring a documented asset inventory programme; covered entities certified compliance for the first time in annual reports due April 15, 2026.
Institutions running industrial or operational technology alongside their IT estate face a fourth clock; our OT security statistics dataset covers that reporting environment, and the software-dependency picture behind the third-party numbers above is tracked in open source vulnerability statistics. For the internal-actor share that the ESAs record as human error, see insider threat statistics. Detection and fraud-prevention spending on the countermeasure side is covered in AI in banking statistics, and consumer-facing losses in credit card fraud statistics and digital identity fraud statistics.
Methodology
Collection. Every figure in this article was retrieved on September 4, 2026 from a primary document opened during production: the ESAs 2025 Report on major ICT-related incidents (JC 2026 16), the IMF Global Financial Stability Report April 2024 Chapter 3, the IBM 2026 Cost of a Data Breach release of July 29, 2026, the ITRC H1 2026 Data Breach Report release, the ESMA DORA page, the ECB Banking Supervision press release of July 26, 2024, and the SEC small-entity compliance guide for the cybersecurity disclosure rules. No figure here is sourced from secondary aggregation or from prior recall. Each has a row in the accompanying CSV with source organisation, document, URL and retrieval date.
Axis calculations. All derived figures carry axis_calculated = yes and a method_note containing the arithmetic. The two named metrics, FCTR and TPI, carry data_type = original_metric. Both were computed in Python from published source values and both are reproducible by any reader from the cited tables and figures.
Index construction. FCTR uses the IMF’s own generalised extreme value estimates without reweighting, because both numerator and denominator come from the same model, the same dataset and the same estimation years, the only condition under which a ratio of two fitted distributions carries meaning. TPI uses two shares from a single reporting population and a single twelve-month window for the same reason. Where inputs could not be placed on one consistent basis, no figure was computed. The financial services cost premium is published as a 2026 snapshot rather than a series for exactly this reason.
Refusals. One calculation was attempted and rejected: a year-over-year financial services breach cost premium series. It is recorded in the dataset with data_type = retracted and the reasoning in its method note.
Reporting boundaries. The ESAs figures cover EU financial entities only and exclude roughly 15% of 2025 major incidents for which no final report had arrived by the February 5, 2026 cutoff; the ESAs also note divergent reporting practices across sectors and jurisdictions in this first year. IMF figures rest on the Advisen loss database as of February 22, 2024 and on modelled estimates, not observed maxima. IBM figures reflect 602 self-selected organisations. ITRC figures are US publicly notified compromises. These datasets are not interchangeable and are not merged anywhere in this article.
About This Dataset
File: financial-services-cybersecurity-statistics-2026.csv, 108 rows, 14 columns, UTF-8, comma-separated.
Columns: metric, value, unit, as_of_date, geography, segment, source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated, method_note, data_type.
Coverage: EU major ICT incident reporting under DORA for calendar 2025; global and financial-sector breach cost for the March 2025 to February 2026 window; IMF modelled cyber loss distributions for 2017 and 2021 and reported sector losses 2004 to 2023; US financial services data compromises for 2025 and H1 2026; incident reporting deadlines in force as of September 2026.
License: Creative Commons Attribution 4.0 International (CC BY 4.0). Free to reuse, republish and redistribute with attribution.
How to Cite This Research
APA: Axis Intelligence Research. (2026). Financial services cybersecurity statistics 2026: Incidents, cost, and the third-party multiplier. https://axis-intelligence.com/financial-services-cybersecurity-statistics/
MLA: Axis Intelligence Research. “Financial Services Cybersecurity Statistics 2026: Incidents, Cost, and the Third-Party Multiplier.” Axis Intelligence, 4 Sept. 2026, axis-intelligence.com/financial-services-cybersecurity-statistics/.
Chicago: Axis Intelligence Research. “Financial Services Cybersecurity Statistics 2026: Incidents, Cost, and the Third-Party Multiplier.” Axis Intelligence, September 4, 2026. https://axis-intelligence.com/financial-services-cybersecurity-statistics/
Frequently Asked Questions
How many major ICT incidents did EU financial entities report in 2025?
EU financial entities reported 3,383 major ICT-related incidents in 2025, the first full year under DORA Article 19, at an average of 282 per month and 0.18 per regulated entity. More than 60% came from the credit sector and 16% from payments. Roughly 15% of 2025 incidents were excluded from the total because no final report had been submitted by the February 5, 2026 cutoff.
Are most financial sector incidents caused by hackers or by IT failure?
By IT failure. System failures accounted for 51% of major incidents in the EU in 2025 and were the root cause of half of them. Cybersecurity incidents accounted for 10%. Third-party provider failures caused 29%, which gives an Axis Third-Party Incidence Ratio of 2.9, a European financial entity was roughly three times more likely to file over a supplier failure than over an attack.
What is the Axis Financial Cyber Tail Ratio?
FCTR is an Axis Intelligence Research metric comparing a financial firm’s modelled worst-case annual cyber loss with the same estimate for firms generally, expressed as an index where 100 means parity. Computed from the IMF’s April 2024 extreme value estimates, it moved from 36.2 in 2017 to 107.8 in 2021 at the median, and from 53.2 to 90.2 at the 90th percentile.
How much does a financial services data breach cost in 2026?
IBM’s 2026 study put the financial services average at $6.3 million against a $4.99 million global average across 602 organisations breached between March 2025 and February 2026. That is a premium of 126.3 on the Axis calculation, or $1.31 million per breach. Healthcare was higher at $6.64 million; financial services ranked second of 17 industries.
Does a bank have to notify regulators within four hours of a cyberattack?
Under DORA, an EU financial entity must file an initial notification within four hours of classifying an incident as major, and in any case within 24 hours of becoming aware of it. The four-hour clock starts at classification, not at detection. An intermediate report follows within 72 hours and a final report within one month of the intermediate report.
When does the SEC four-day cybersecurity disclosure clock start?
It starts when the registrant determines the incident is material, not when the incident is discovered. The registrant must make that materiality assessment without unreasonable delay, then file a Form 8-K under Item 1.05 within four business days. This is why a firm can owe a DORA notification in four hours and an SEC filing weeks later for the same event.
Which financial subsector is most exposed to ransomware?
In the EU’s 2025 reporting, ransomware among cybersecurity-classified major incidents skewed toward insurance rather than banking, which the ESAs attribute to the volume of sensitive health and financial data insurers hold. Banks’ cybersecurity incidents concentrated instead in distributed denial of service at 33% and data exfiltration and manipulation at 31%.
How concentrated is third-party risk across major banks?
The IMF found that more than 50% of the IT providers serving global systemically important banks supply two or more of them. The comparable figures are about 20% for major insurers and about 25% for major asset managers. This overlap is what turns a single supplier failure into simultaneous incidents at multiple institutions.
How many US financial institutions disclosed a data compromise?
The ITRC recorded 739 US financial services data compromises in calendar 2025 and 387 in the first half of 2026, the highest of any sector in both periods. Financial services held 22.25% of all US compromises in 2025 and 21.46% in H1 2026. Only 24% of H1 2026 notices disclosed an attack vector, the lowest disclosure rate the ITRC has recorded.
Can I reuse this data?
Yes. The dataset is published under CC BY 4.0. Cite as: Axis Intelligence Research, Financial Services Cybersecurity Statistics 2026, axis-intelligence.com.