The financial services sector in the Asia Pacific is one of the most cyber attacked sectors in the world, and Australia, Singapore and Japan are the top three most targeted countries – together accounting for more than three-quarters of all web application and API incidents.  

A report from Nasdaq-listed Akamai Technologies says there were over 3.7 billion of these attacks in the year to June as financial institutions accelerate digital innovation. 

“As global financial hubs, it is no surprise that organisations in Australia, Singapore and Japan continue to experience massive, targeted attacks,” it said. 

The Asia Pacific financial services sector is one of the most innovative and competitive in the world, Akamai regional Security Technology and Strategy Director Reuben Koh says, and institutions are increasingly turning to third-party scripts to add new offers and features. 

As financial institutions in the region develop more channels and better customer experiences, 40% of scripts used are third party. 

“Businesses usually have limited visibility into the authenticity and potential vulnerabilities of these scripts, introducing yet another layer of risk to the business,” he said. "Threat actors now have yet another vector to launch attacks. 

"Organisations are at severe risk as they expand their digital footprint to reach more customers and gain a competitive edge.” 

More cyber criminals are using bots to amplify the scale and effectiveness of attacks. Examples include website “scraping” to impersonate the websites of financial services brands for phishing scams, and credential “stuffing” via automated injections of stolen usernames and passwords for account takeovers.  

"Threat actors are constantly evolving their techniques and have started to focus their attacks on financial service consumers to get the most return on investment,” Mr Koh said. 

 The finance sector accounts for half of all web application and API attacks. Local File Inclusion (LFI) remains the top attack vector, accounting for 63% of attacks – with Cross-Site Scripting and PHP Injection also featuring.  

LFI attacks exploit vulnerabilities to execute code remotely or gain access to sensitive information stored locally. Older PHP-based web servers are more vulnerable to LFI attacks. 

“The rising popularity of financial aggregators and especially those organisations keen to adopt open banking practices will mean that the industry will begin to be even more dependent on the use of APIs and third-party scripts moving forward – expanding attack surfaces even further,” Mr Koh said.  

 See the report here.