Reference Case Number: FOI9169
Freedom of Information: Right to know request:
- The number of monthly cyber incidents involving asset management firms, dating from January 2019 to the latest date available.
- The percentage of these cyber incidents that involved ransomware.
- The percentage of these cyber incidents that involved breach/compromise of confidential information or personal data.
FCA response:
Firstly, it may be helpful to note that we hold centralised records on major operational incidents reported to the FCA by individual firms under SUP 15.3 and Principle 11. This includes incidents that are a result of cyber-attacks. However, please note that these figures do not include cyber incidents at FCA regulated firms that have not been reported directly to the FCA.
Please note that all data is accurate as of the 8 April 2022 and is subject to change due to ongoing investigations of incidents. We will now respond to each question in turn below.
For question 1, please see below for the monthly cyber incidents involving asset management firms, dating from January 2019 to February 2022 (which is latest date available).
FOI9169
|
Month (2019-2022) |
Number of cyber incidents in Assets Management Portfolio |
|---|---|
|
Jan-19 |
0 |
|
Feb-19 |
0 |
|
Mar-19 |
1 |
|
Apr-19 |
0 |
|
May-19 |
1 |
|
Jun-19 |
0 |
|
Jul-19 |
0 |
|
Aug-19 |
1 |
|
Sep-19 |
1 |
|
Oct-19 |
1 |
|
Nov-19 |
0 |
|
Dec-19 |
0 |
|
Jan-20 |
2 |
|
Feb-20 |
1 |
|
Mar-20 |
0 |
|
Apr-20 |
0 |
|
May-20 |
0 |
|
Jun-20 |
2 |
|
Jul-20 |
4 |
|
Aug-20 |
3 |
|
Sep-20 |
3 |
|
Oct-20 |
0 |
|
Nov-20 |
3 |
|
Dec-20 |
1 |
|
Jan-21 |
2 |
|
Feb-21 |
2 |
|
Mar-21 |
1 |
|
Apr-21 |
1 |
|
May-21 |
0 |
|
Jun-21 |
0 |
|
Jul-21 |
0 |
|
Aug-21 |
1 |
|
Sep-21 |
0 |
|
Oct-21 |
0 |
|
Nov-21 |
0 |
|
Dec-21 |
0 |
|
Jan-22 |
0 |
|
Feb-22 |
0 |
|
Total Jan 19-Feb 22 |
31 |
For question 2, of all the incidents recorded in question 1, 2 incidents were recorded as ransomware January 2020 and July 2020, respectively. This equates to 6% of the total number of cyber incidents reported in the Asset Management portfolio from January 2019 to February 2022.
For question 3, of all the incidents recorded in question 1, 11 incidents were recorded as involving breach/compromise of confidential information or personal data. This equates to 33% of the total number of cyber incidents reported in the Asset Management portfolio from January 2019 to February 2022.