June 6, 2016 By Douglas Bonderud 2 min read

Another day, another SWIFT attack. That’s the word from SecurityWeek, which detailed a string of fraudulent transactions between Wells Fargo and Ecuador’s Banco del Austro (BDA). Now, BDA is suing Wells Fargo while SWIFT is looking for speedy ways to safeguard its money moving service. Both the initial response and ultimate responsibility are under scrutiny as companies hope to fast-track worry-free transfers.

Third Time’s the Charm?

This is the third big SWIFT breach reported. The Vietnamese Tien Phone Bank suffered losses in 2015, and the Bangladesh Central Bank (BCB) lost $81 million in February 2016.

BDA’s attack goes further back: On Jan. 12, 2015, at least 12 fraudulent transfer requests were made to Wells Fargo, supposedly from BDA, asking the company to move $12 million to accounts in Hong Kong, Dubai and the U.S. SWIFT wasn’t in the loop until a Reuters investigation turned up court documents of the BDA/Wells Fargo lawsuit.

Unlike BCB, which blamed its losses on SWIFT, BDA is suing Wells Fargo directly. For its part, Wells Fargo said it “properly processed the wire instructions received via authenticated SWIFT messages” and therefore isn’t responsible, SecurityWeek stated.

SWIFT, meanwhile, makes the point that it can’t help anyone if companies don’t report these frauds directly. According to ITProPortal, SWIFT is adamant that the network has not been compromised.

Walk of Blame

So who’s responsible for the BDA SWIFT attack? What about Bangladesh, Vietnam or others that haven’t been reported? SC Magazine noted that there’s some evidence pointing to North Korea: It’s likely that the country’s Lazarus Group is responsible for the BCB attack and possibly other high-value SWIFT breaches. According to CNN, a federal probe has been launched to determine the extent of North Korean involvement.

Of course, pinning down attackers doesn’t patch security holes. SWIFT argued that banks need to beef up network defenses, watch more carefully for fraudulent activity and always report any SWIFT-related issues. Banks, meanwhile, are calling on SWIFT to do a better job of protecting the system from malicious access, which would in turn negate the need for increased bank oversight of the process.

Learning From the SWIFT Attack

Bottom line? It’s a chicken-and-egg scenario, but being right doesn’t really matter if millions are rapidly disappearing. As noted by Bloomberg, SWIFT is taking action to solve the problem at its end. But while CEO Gottfried Leibbrandt said it’s aiming for some “quick wins” in the near future, “the full rollout, the full shore-up, will be a matter of years.”

SWIFT is trying, but it won’t happen overnight. Response and responsibility rest with banks — at least in the near term. For BDA, suing Wells Fargo might provide some temporary relief, but with new and historic SWIFT attacks emerging, time and effort may be better spent hunting down fraudulent transactions and providing SWIFT the data it needs to slow attacker progress.

More from

What does resilience in the cyber world look like in 2025 and beyond?

6 min read -  Back in 2021, we ran a series called “A Journey in Organizational Resilience.” These issues of this series remain applicable today and, in many cases, are more important than ever, given the rapid changes of the last few years. But the term "resilience" can be difficult to define, and when we define it, we may limit its scope, missing the big picture.In the age of generative artificial intelligence (gen AI), the prevalence of breach data from infostealers and the near-constant…

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today