Cyber attacks and data breaches reported to the FCA - February 2022

Please note that we hold centralised records of major operational incidents reported to the FCA by individual firms under SUP 15.3 and Principle 11. These records include incidents that are a result of cyber-attacks.

These records, however, do not include cyber incidents at FCA regulated firms which have not been reported directly to the FCA.

Please note that the above data is accurate as at 26 January 2022 but are subject to change due to ongoing investigations of incidents.

Of the cyber incidents reported to the FCA in 2021, as outlined above in point A, the following were identified as being a result of a cyber attack.

Of the 116 cyber incidents reported to the FCA in 2021, 37 cyber incidents involved a data breach. Due to the nature of cyber incidents, this number is subject to change should further information be identified that indicates the occurrence of a data breach.

Where a firm has notified the FCA of a cyber-attack, the FCA will assess whether the incident involves a breach or compromise of company and/or personal data from the initial incident report provided by the firm – at which point the firm will be reminded of their obligation to report to the ICO.

By way of context, where a firm notifies the FCA of a cyber-attack, the FCA records the root cause component of those cyber-attacks in one of the following ways:

• Cyber – 3rd Party
• Cyber – Malware
• Cyber – Phishing
• Cyber – Ransomware

The above table contains the number of incidents which were reported to the FCA and recorded using the ‘Cyber – Ransomware’ tag.

As per the response to Question D above, the figures in the above table contain the number of incidents reported to the FCA which were recorded using the ‘Cyber – Ransomware’ tag.