Banks did not see massive failures – Finance – Kommersant

Mobile applications and services of a number of Russian banks, including Tinkoff-Bank, Alfa-Bank, Raiffeisenbank, Sberbank and others, were unavailable to customers for several hours. Kommersant’s interlocutors in the cybersecurity market believe that the IT infrastructure of one of the partners of all banks for data storage could have been attacked. As another version, experts call problems with updating foreign software. Banks do not confirm massive failures, some only recognize individual technical difficulties with individual clients.

Clients of Russian banks: Tinkoff-Bank, Alfa-Bank, Raiffeisenbank, Sberbank, MTS-Bank — faced problems during the day when logging into the application. This was reported by users of social networks, the correspondents of Kommersant were convinced of the existence of problems.

Raiffeisenbank denied information about failures in the application. “The entrance to the application is working properly,” Kommersant was told there. Alfa-Bank acknowledged that “due to technical work, a small part of customers might temporarily not be able to enter the application.” The bank emphasized that technical work is regularly carried out – “this is part of its daily activities.” Sberbank said: “The mobile application and all other systems of Sberbank are operating normally. Due to difficulties on the side of partner banks, transfers to other banks may be limited for some customers.”

Later during the day, according to users, banking services were restored.

Kommersant’s interlocutor in the information security market says that the reason for the simultaneous failure of the applications of several banks may be a problem in the operation of one of the data processing centers (DPC).

This theory is confirmed by another Kommersant source in the information security sector: “An attack could have been made on the gateway of one data center service provider that provides services to several organizations.” In addition, he adds, if the attack, for example, was on one or two of his clients, others could also be affected.

As the second possible reason, the interlocutor cites problems with equipment that could be used in all banks and work on foreign software: “Cornyly, they could stop updating routers.”

Such a problem, according to him, is quickly resolved, but it is impossible to predict it.

If you look at requirements FSTEC of Russia for critical information infrastructure facilities, which also apply to financial organizations, then banks should begin to build their protection system, starting from negative consequences, among which there is a temporary unavailability of the service provided, says Alexey Lukatsky, Positive Technologies information security business consultant: “Following the approaches of the Central Bank, financial institutions should not only highlight such negative consequences, called key risks, but also assess the time during which the service may be unavailable, and this will not be considered a violation.”

The Ministry of Digital Development has gone even further, the expert notes, and believes that business should determine for itself what has catastrophic consequences for it, which can be expressed not only in the duration of downtime of the financial service, but also in the loss of reputation, lost profits, the number of affected users.

Earlier, on December 6, VTB infrastructure has undergone the most powerful cyberattack in its history from abroad, the press service of the bank said: “It has become the largest not only this year, but also for the entire time the bank has been operating.” According to the previously published Central Bank “Review of reporting on information security incidents in the transfer of funds”, in the third quarter fixed the maximum amount of fraud this year and the second result in history – almost 4 billion rubles.

Yulia Tishina, Tatiana Isakova, Finance Department