Financial services is the second most frequently breached sector by ransomware and data extortion groups in H1 2026, accounting for approximately 12% of confirmed incidents across tracked groups. The sector’s combination of high-value data (account credentials, card numbers, loan portfolios, M&A intelligence), regulatory reporting requirements that create time pressure during incidents, and payment capability make it a priority target for RaaS affiliates choosing victims.
This report covers the current threat landscape against banks, insurers, payment processors, wealth managers, and investment firms.
The Financial Sector Threat Actor Landscape
Several ransomware operations have demonstrated sustained focus on financial services targets in 2026:
RansomHub is the most prolific against financial targets in 2026. The group’s affiliate model attracts experienced operators who are selective about targets — financial institutions with high payment capacity and regulatory pressure are specifically chosen. RansomHub affiliates have demonstrated proficiency with financial sector tooling: they move through Active Directory to locate financial application servers, backup infrastructure, and the document stores containing customer account data. The group’s 90/10 affiliate revenue split (affiliates receive 90%) attracts skilled operators away from competing operations.
Akira has maintained steady financial sector targeting, particularly against regional banks, credit unions, and insurance carriers. Akira’s initial access through unpatched SonicWall and Cisco VPN appliances (documented in multiple advisories) aligns well with financial institutions that run legacy perimeter infrastructure. Double extortion is standard — victim data is published on Akira’s leak site if payment is not made, and the data frequently includes customer PII that creates immediate GDPR, UK GDPR, or state privacy law notification obligations.
Cl0p (Clop) operates primarily through mass exploitation of file transfer software — MOVEit, GoAnywhere, Cleo — rather than traditional ransomware deployment. Financial services has been disproportionately represented among Cl0p victims because file transfer software is heavily used in the sector for inter-institution transfers, regulatory submissions, and secure client document exchange. Cl0p typically does not encrypt files; it exfiltrates and extorts. Payment demand is made without the operational disruption of encryption, making victim detection sometimes slower.
Black Basta has been active against larger financial institutions — banks with multi-country operations and private equity firms. The group’s use of Qakbot and Cobalt Strike for initial access and its speed of lateral movement (frequently reaching domain admin within 24 hours) is well-documented. Black Basta’s double extortion pattern focuses on the highest-value documents: board communications, M&A deal data, and regulatory correspondence.
LockBit 5 (Chuong Dong variant, 2026 resurgence): Following law enforcement disruption in 2024 and the subsequent iterations, LockBit affiliates continue to operate under the updated brand. Financial sector targeting persists, though the brand’s reputation damage has led some experienced affiliates to move to RansomHub and Akira. LockBit 5 retains significant capability and continues active leak site operations.
Financial Sector-Specific TTPs
Experienced affiliates adapt their playbooks for financial environments:
Targeting backup and DR infrastructure first: Financial institutions typically run robust backup infrastructure to meet RTO/RPO regulatory requirements. Ransomware operators have learned to target Veeam, Commvault, and Veritas backup servers before deploying the encryptor — deleting or corrupting backups to maximise recovery time and payment pressure. Attacks that land in the backup environment first are often undetected until the encryptor runs days later.
Time pressure amplification: Financial services operates under DORA (Digital Operational Resilience Act) in the EU/EEA, which requires notification of major ICT incidents within defined timelines. In the UK, the FCA requires material operational disruption notification within 24-72 hours. Ransomware operators are aware of this and use it as leverage — the clock on regulatory notification runs whether or not the victim is engaging in negotiations.
Data targeting for maximum extortion leverage: Operators specifically search for: customer account data (account numbers, balances, transaction history), AML/KYC investigation files, insider trading investigation documents, M&A deal files, regulatory examination correspondence, and board or executive communications. Each category creates independent leverage: regulatory breach, client notification obligations, or reputational damage.
SWIFT and payment system lateral movement: In attacks on banks, advanced operators attempt to reach SWIFT messaging infrastructure, core banking systems, or payment processing platforms. Disruption to these systems triggers regulatory reporting requirements and can cause systemic impacts that increase payment pressure significantly. The 2016 Bangladesh Bank SWIFT fraud is the established template; ransomware operators study it.
Swift initial access to regulatory file stores: Attacks timed to quarter-end or regulatory submission deadlines exploit the operational pressure on financial institutions that must file reports regardless of their IT situation.
Ransom Payment Patterns in Financial Services
Financial services firms pay ransoms at a higher rate than the general victim population — estimates suggest 60-70% payment rates versus a cross-sector average of 40-50%. Contributing factors:
Regulatory payment restrictions: OFAC guidance in the US and equivalent frameworks in the EU and UK restrict payments to sanctioned entities. Financial institutions are more sensitive to OFAC compliance than most sectors, which means legal review of payment decisions is standard practice. This can paradoxically increase payment rates — structured legal review often results in payment with documentation rather than a unilateral refusal.
Business continuity pressure: A bank that cannot process payments faces immediate customer impact, regulatory scrutiny, and potential systemic effects. The calculus of “pay and recover quickly” versus “restore from backup” often favours payment when backup restoration times are measured in days or weeks and customer impact is immediate.
Cyber insurance: Financial services firms have high cyber insurance penetration compared to other sectors. Insured firms show higher payment rates — insurance companies often prefer payment (capped by policy limits) over extended recovery costs that exceed the ransom.
Average ransom demand in the financial sector in H1 2026: £2.8M–£14M depending on institution size. Average actual payment (where payment occurred): approximately 40-60% of initial demand after negotiation.
DORA Compliance During a Ransomware Incident
The Digital Operational Resilience Act (DORA), in force since January 2025, creates specific obligations for financial services firms (banks, insurers, investment firms, payment institutions, and their critical ICT third-party providers) during ransomware incidents:
Major ICT incident classification: Ransomware will almost always qualify as a major ICT incident under DORA criteria (significant operational impact, data breach, duration exceeding thresholds). Classification triggers the formal reporting timeline.
Reporting timeline:
- Initial notification: within 4 hours of classification as a major incident (or 24 hours of first becoming aware that a major incident may have occurred)
- Intermediate report: within 72 hours of initial notification
- Final report: within 1 month of incident resolution
Practical implication: Ransomware incidents that encrypt operational systems will be classified as major within hours. The 4-hour initial notification clock begins at that classification — not at the point of recovery. Organisations without a tested incident notification workflow will struggle to meet this timeline while simultaneously managing the technical response.
DORA also requires testing of digital operational resilience including threat-led penetration testing (TLPT) for significant institutions. A ransomware incident that exposes fundamental weaknesses in detection or response capability will attract supervisory scrutiny about whether those weaknesses should have been identified in required testing.
Defensive Priorities for Financial Services
Ransomware-specific controls that matter most:
-
Immutable backup verification: Test backup restoration quarterly. Ensure backups are air-gapped or immutable (Veeam Hardened Repository, AWS S3 Object Lock). Most post-ransomware recovery failures are backup failures discovered under stress.
-
Privileged access workstations for domain admin and backup admin: These accounts are the primary target. Requiring PAW access for privileged operations prevents lateral movement via credential theft from standard workstations.
-
Network segmentation of SWIFT and payment infrastructure: These systems should be on isolated network segments with deny-by-default outbound rules. Any deviation from baseline network connections should alert.
-
DORA incident classification playbook: Have a written, tested decision tree for classifying ICT incidents against DORA major incident criteria. The 4-hour notification clock cannot be met if the classification decision takes 3.5 hours.
-
Ransomware tabletop with legal and compliance: Run a tabletop exercise that includes the OFAC payment analysis, regulatory notification decisions, and board communication under time pressure. Most firms have technical IR playbooks but few have exercised the governance and legal decisions that ransomware forces.