The “biggest cyberattacks in history” hit five US megabanks in succession last month, according to this CNN headline. While it will be hard ever to be certain about all the details–nearly everyone involved in the matter has an incentive to tell less than the whole truth–it now appears that the attacks had relatively modest impact on financial operations.
All public reports agree that the attacks were of the “denial-of-service” (DOS) variety. While a DOS might in principle play a role in hostile exploration of other vulnerabilities, there’s no evidence that any of last months attacks came close to accessing the back-end databases which host bank financial accounts, or even any specific individual transactions. The gross return from the whole episode might be less than that from one incident of looking over a coffee-shop patron’s shoulder.
On the other hand, it appears hundreds of thousands of customers might have been affected over the span of the attacks. Although the effect was delays and loss of access, not theft of funds, those delays were doubtless costly to at least a few individuals who expected quick responses from their banks.
Various experts speculated that the attacks might have been the responsibility of the government of Iran, activists not directly controlled by the government of Iran, or perhaps someone neither “state-sponsored” nor associated with Iran.
Commentators generally give the banks involved middling-to-high marks for their responses to the attacks. Banks have grown in sophistication in recent years, and are far better equipped than in the past to weather these storms.
At a social level, “storm” is probably the right image for analysis of the implications of DOS. Customers are forgiving of banks that shut their doors for flood, fire, or blizzard, as long as the accounts and assets remain intact for a subsequent re-opening. That’s how this cyberattack appeared to play out.
Sysops will want to know of services like dotcom-monitor that specialize in sober diagnosis of Website responsiveness. At a personal level, the episode is also a lesson in expectations: if you plan your life to such narrow tolerances that a minor outage is a calamity for you, you’re cutting things too close. Pay your bills a week ahead of their due dates, and sleep better at night.