Cyber attack on major bank could spread quickly: Fed

A well-timed cyber attack on a single large bank could spread rapidly through the U.S. financial system by dramatically impairing the flow of credit between financial firms, according to new research from the Federal Reserve Bank of New York.

Worries about financial crises are often linked to market concentration and excessive risk taking. But the Fed paper makes clear policymakers see cyber security as another possible key trigger for a financial debacle.

"We model how a cyber attack may be amplified through the U.S. financial system, focusing on the wholesale payments network," write economists Thomas Eisenbach, Anna Kovner and Michael Junho Lee.

"We estimate that the impairment of any of the five most active U.S. banks will result in significant spillovers to other banks, with 38% of the network affected on average."

Financial service firms experience up to 300 times as many cyber attacks per year as companies in other sectors, according to Boston Consulting Group data cited in the NY Fed research.

The attackers' level of knowledge on the timing and function on the payments system would be key to the size and scope of any attack, the authors say.

"One distinguishing feature of cyber attacks is that they may be designed for maximum disruption. Past studies highlight that total payment activity is often heightened at predictable, regular days over the course of the year," they write.

"Attacks on seasonal days associated with greater payment activity are more disruptive relative to a non-seasonal days, with average impacts that are about 13% greater."

Similarly, "a cyber attacker with specific knowledge of a targeted institution that targets the attack to a particular date could produce impairments that are another 10% larger than seasonal day disruptions."

They estimate that, on average, an attack that comes on the worst date for a particular large institution adds an additional 25% in impairment relative to the case of one backed with no specific knowledge.

"When banks respond to uncertainty by liquidity hoarding, the potential impact in forgone payment activity is dramatic, reaching more than 2.5 times daily GDP," the New York Fed economists conclude.

"In a reverse stress test, interruptions originating from banks with less than $10 billion in assets are sufficient to impair a significant amount of the system. Additional risk emerges from third-party providers, which connect otherwise unrelated banks."