Only health notified more data breaches than financial services in 2025.
Financial services notified 157 of the 1,205 data breaches reported to the OAIC in 2025, second only to health service providers. The ICBC ransomware event disrupted clearing of US Treasury trades, and the August 2025 compromise of Marquis Software, a single vendor, reached 74 US banks and credit unions. Researchers linked ICBC to an unpatched edge appliance; at Marquis, attackers came in through the vendor's SonicWall firewall.
Why Financial Services is in the crosshairs
Five shifts shaping the financial services threat environment — from customer fraud to systemic disruption, and from documentation to demonstration.
The attack volume is structural, not cyclical
Boston Consulting Group's 2019 finding that financial firms are targeted around 300 times as often as other companies captures something fundamental: financial services holds directly monetisable data (payment credentials, account access, tax and identity information) and is a gateway to wire-fraud attacks. This does not go away with a good quarter of defensive investment.
The pattern has shifted from customer fraud to systemic disruption
Colonial Pipeline taught one lesson about critical infrastructure; ICBC's November 2023 ransomware incident taught an equivalent one for finance. A single compromise disrupted clearing of US Treasury trades, forcing BNY Mellon to unplug ICBC from the Treasury market and requiring manual trade clearing via USB stick. DBRS Morningstar framed it as showing "the potential effect of a major disruption of the global payment system."
Third-party and partner-bank exposure dominates the threat picture
Marquis Software in August 2025 affected 74 US banks and credit unions after attackers breached the vendor's SonicWall firewall. Evolve Bank & Trust in 2024 exposed 7.6 million customers, with Affirm and Wise downstream. The breach of Infosys McCamish, a third-party plan administrator, prompted Bank of America customer notifications. The pattern: attack a specialist provider, compromise many institutions at once.
The root causes are the ones continuous validation is built to find
Sophos' 2025 finance sector data identifies the top operational root causes as "lack of or poor-quality protection" (66%) and "security gaps, known or unknown" (67%). Misconfigurations, exploitable attack paths, weak identity hygiene, exposed edge services — these are exactly what attack-based testing surfaces before a real adversary does.
Regulation is converging on the "prove it works" demand
APRA CPS 234 requires information security commensurate with threat level. CPS 230 operational resilience is now in force. CORIE exercises stress-test major entities. Europe's DORA is in force. The US SEC's 2023 cyber disclosure rules require material incidents to be disclosed within four business days of determining they are material. Regulators here and overseas are moving in the same direction — demonstration of effective controls, not just documentation of their existence.
What regulators and experts are saying
It's highly unusual for a bank as big as ICBC to be hit with this disruptive of a ransomware attack.
Ransomware attacks primarily affected service providers (29%) and insurance organisations (17%), with impacts including financial loss (38%), data exposure (35%), and operational disruption (20%).
Failure to establish effective risk assessment processes prior to migrating significant information technology operations to the public cloud.
APRA CPS 230 is now in effect
Since 1 July 2025, APRA CPS 230 requires tested resilience of critical operations — and CPS 234 separately mandates systematic testing of information security controls, with board accountability
APRA-regulated entities — banks, credit unions, building societies, general and life insurers, private health insurers, and superannuation trustees — must comply with Prudential Standard CPS 234 (Information Security). CPS 234 is a principles-based standard requiring controls commensurate with the size and extent of threats to information assets. It explicitly mandates systematic testing of control effectiveness. Entities that store, process, or transmit cardholder data must also comply with PCI DSS v4.0.1, which has 12 principal requirements — all future-dated requirements became mandatory on 31 March 2025. CPS 230 (Operational Risk Management) also requires regulated entities to manage the risks of their material service provider arrangements; pre-existing arrangements were covered from their next renewal, or 1 July 2026 at the latest.
Principles-based standard covering nine areas, from board responsibility and control implementation to systematic testing and APRA notification. Applies to all APRA-regulated entities (~1,150 entities overseeing $9.8 trillion in assets).
Applies to financial services entities that store, process, or transmit cardholder data. All future-dated v4.0.1 requirements became mandatory 31 March 2025.
ASD's baseline set of mitigation strategies. CPS 234 does not mandate it, but its controls (MFA, patching, restricting admin privileges) are among those an entity can use to keep controls commensurate with threats.
Where NodeZero applies
An internationally recognised information security management standard that some entities hold alongside their CPS 234 obligations.
Where NodeZero applies
Often requested by regulated clients of technology and managed service providers as assurance over their controls.
Where NodeZero applies
Financial institutions handle significant volumes of personal and sensitive financial information subject to the Australian Privacy Principles.
Where NodeZero applies
Mandatory ransomware payment reporting applies over $3M turnover; SOCI-regulated assets carry separate incident notification obligations.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
APRA CPS 230 — Operational resilience
1 Jul 2025Requires tolerance levels for each critical operation (maximum disruption period, data loss and minimum service levels) and a systematic program testing business continuity plans against severe but plausible scenarios, including an annual exercise. The board approves the plan and tolerance levels.
Cyber Security Act 2024
30 May 2025Mandatory ransomware payment reporting within 72 hours for entities over $3M turnover. NodeZero tests the techniques ransomware operators rely on (credential abuse, lateral movement, privilege escalation) safely in production.
Privacy Act statutory tort
10 Jun 2025Private right of action for serious invasions of privacy that are intentional or reckless, in force from 10 June 2025. Separately, since December 2022 maximum penalties for serious privacy breaches have been the greater of $50M, three times the benefit obtained or 30% of adjusted turnover.
PCI DSS v4.0.1 — All requirements mandatory
31 Mar 2025All 51 future-dated requirements became mandatory on 31 March 2025. Requirement 11.4 penetration testing continues alongside them: annually and after significant change, with segmentation testing six-monthly for service providers and annually for merchants.
Find your organisation
See how the changes affect you specifically
Banks & ADIs
Big 4, regional banks, and authorised deposit-taking institutions. APRA CPS 234 applies in full, with the board ultimately responsible for information security.
View details →Insurers & superannuation
General insurers, life insurers, and superannuation trustees. The same APRA CPS 234 requirements as banks, protecting highly sensitive member and policyholder data.
View details →Payments & fintech
Payment processors, neobanks, and fintech companies. PCI DSS v4.0.1 is fully mandatory with all 51 future-dated requirements now in effect.
View details →Why security teams trust NodeZero
Find what an attacker could reach before your next APRA review
See NodeZero run in your own environment, and where it applies to CPS 234, CPS 230 and PCI DSS