BaFin Website Remains Down for Fourth Day after Cyberattack

<p>A
Distributed Denial of Service (<a href="https://www.financemagnates.com/tag/ddos-attack/" target="_blank" rel="follow">DDoS</a>) attack is one of the simplest yet highly
effective forms of cyberattacks that can cripple even the most well-guarded
websites with the most efficient servers. This past weekend, the German
financial market regulator, BaFin, experienced this firsthand as its website
has been inaccessible since Friday. However, the institution assures its other
systems are functioning without issues.</p><p>BaFin Reports Cyberattack</p><p>The German
regulator announced on its official X channel (formerly Twitter) today (Monday)
that it fell victim to a <a href="https://www.financemagnates.com/terms/d/ddos-attack/">DDoS attack</a> on Friday. It decided to block access to
its website while implementing other security measures as a remedial measure. </p><p>"These
measures are currently causing the website to be temporarily unavailable. All
other BaFin systems are functioning without restriction," <a href="https://www.financemagnates.com/tag/bafin/" target="_blank" rel="follow">BaFin </a>commented
in a social media post translated from German to English.</p><p>BaFin also
claims that its website is currently available to a limited extent. At the time
of writing this article, attempts to access bafin.de proved unsuccessful,
displaying a message that the site was unreachable. This information is confirmed by the website service called 'Is It Down Right Now?' which monitors websites activity:</p><p>According to Mate Ivanszky, the CEO and Founder of Matworks, a cybersecurity company, such a prolonged downtime, especially when discussing an important financial institution, is not normal. What is more, he believes the attack may have been more than a mere DDoS. </p><p>“The attack
went far beyond what they claim, with possibility of their website web
services being hacked, and it would be too risky for them to bring something that it is
infected back online. In such events, the downtime is expected to be much more
prolonged, as you may need much more than SOC (Security Operations Center) in this case, potentially
forensic investigation, assessment of IT resources, and perhaps, assess losses
and level of compromise (with the possibility of their backups being
compromised too),” Inanszky commented in an e-mail sent to Finance Magnates.</p><p>Financial Industry
Vulnerable to Hacker Attacks</p><p>The
financial industry is an extremely attractive target for hackers who try to
infiltrate the systems of public institutions and private companies. Finance
Magnates has <a href="https://www.financemagnates.com/forex/cysec-warns-against-impersonators-of-officials-representatives/" target="_blank" rel="follow">repeatedly reported</a> on attempts to impersonate employees of
financial regulators and their websites, as well as DDoS attacks in the retail
contracts for difference (CFDs) industry.</p><p>A few
months ago, we described a ransom attack that <a href="https://www.financemagnates.com/forex/exclusive-inside-fxstreets-ddos-attack/" target="_blank" rel="follow">victimized FXStreet</a>, a popular FX
market website. The team was generous and open enough to share their story,
shedding light on the decision-making process in such a delicate situation and
offering valuable tips to our readers.</p><p>In a
separate column, <a href="https://www.financemagnates.com/forex/how-to-survive-a-ddos-attack-and-save-millions/" target="_blank" rel="follow">Ivanszky emphasized</a> that by 2025, we can expect $10.5
trillion in costs resulting from cybercrime. He described how brokers can
protect themselves from DDoS attacks while saving a lot of money.</p><p>A fundamental weakness often found in many studies is simple human mistakes, which are usually the top reason for security issues online. A thorough investigation led by Stanford University disclosed that phishing schemes frequently target individuals and are prone to clicking on harmful links, mainly distributed via email and social platforms.</p><p>Although there are ways to defend against DDoS attacks, no solution will provide a 100% protection. According to Ivanszky, organizations can only do the best possible to be as close as possible to 100%.</p><p>"That is why a defense in depth strategy is needed, that is why an Incidence Response Plan is needed, and even if those fail, when all defenses fail, organizations must have adequate controls in place to ensure disaster recovery and business continuity is achievable within accepted time ranges (which are usually defined in a BCP plan). In the case of BaFin, if the incidence is limited to their website and web services without affecting core services, it might not be enough to trigger a DR/BCP event," Ivanszky concluded.</p>

This article was written by Damian Chmiel at www.financemagnates.com.