KPMG: The ECB found major cyber security deficiencies in some banks

Several European banks have been found to have serious problems in their ability to respond to a simulated cyber attack, in a benchmark test conducted by the European Central Bank (ECB), Bloomberg announces.

According to the quoted source, the ECB will publish, at the end of this week, the conclusions of its tests regarding the banks' response to cyber attacks.

Preliminary information indicates that the banks encountered, in the majority, less serious problems, claims KPMG Germany, which provided consultancy to some banks in this test.

However, some banks face much more serious problems, such as taking far too long to restart their systems or communicate about a cyber attack, says Peter Hertlein, director of cyber security and IT compliance for financial services sector within KPMG Germany.

An ECB spokesman declined to comment on the findings by KPMG Germany.

Last year, the ECB announced that it would test the reaction of European banks to cyber attacks, in the context in which the tensions with Russia brought this topic higher on the list of priorities of the regulatory institution. At the time, the ECB stated that the purpose of the exercise is to improve banks' ability to manage risks, rather than an examination that will have a direct impact on their capital requirements. Meanwhile, several attacks targeting service providers, respectively the consequences of last week's global data blackout have brought to light the vulnerabilities in the global financial system.

"At some banks, it is often not clear which are the responsibilities of the bank and which of the service provider, in the event of a cyber attack," said Peter Hertlein in an interview with Bloomberg. Hertlein did not want to reveal the identity of the banks that his firm advised in the tests.

The test carried out by the ECB included a number of 109 banks, and some were analyzed with greater attention than others, given their systemic importance. During the examination, which began in January, the banks had to face a simulated cyber attack and report to the regulator what measures they had taken.

According to Bloomberg, the ECB will not publish the results of the tests for each individual bank. But Hertlein claims that the regulatory authority will impose deadlines by which the banks must take measures to solve the discovered problems. This means that "banks will have to make investments", warned Hertlein, concluding that, probably, other tests will follow, which will not necessarily be carried out by the ECB, but by the national authorities.