Information on cyber attack Incident reports - April 2022

The number of [cyber attack] incidents which were reported to the FCA nd recorded using the following tags:

1) Cyber – 3rd Party

2)Cyber – Malware

3)Cyber – Phishing

Please provide this data broken down by month.

We can confirm that we hold the requested information, which can be found in Annex A below.

By way of context, it may be helpful to explain that we hold centralised records on major operational incidents reported to the FCA by individual firms under SUP 15.3 and Principle 11. This includes incidents that are a result of cyber-attacks. 

Where a firm has notified the FCA of a cyber-attack, the FCA can record the root cause component / vectors of those cyber-attacks in the following way:

• Cyber – 3rd Party
• Cyber – Malware
• Cyber – Phishing
• Cyber – Ransomware

As requested, the figures in Annex A, include incidents which were reported to the FCA and recorded using the ‘Cyber – 3rd Party’, ‘Cyber – Malware’ and ‘Cyber – Phishing’ tags in 2021, broken down by month.

Please note that:

1. the figures below do not include cyber incidents at FCA regulated firms that have not been reported directly to the FCA; and
2. all data is accurate as of 30 March 2022 and are subject to change due to the ongoing investigations of incidents.

Annex A

1.Cyber – 3rd Party  

2.Cyber – Malware

3.Cyber – Phishing