Filigran Report: 90% of Financial Sector Breaches Driven by Financial Gain as AI and ...

Filigran Report: 90% of Financial Sector Breaches Driven by Financial Gain as AI and Supply Chain Threats Escalate

Shadow AI, third-party compromise and double extortion ransomware converge as DORA makes intelligence-led resilience a regulatory requirement

Filigran , the European open-source threat management company, today released Cyberthreats in the Financial Sector , a report mapping the evolving threat landscape facing financial institutions and the regulatory shifts redefining how they must respond.

The report finds that 90% of breaches affecting financial institutions in 2025 were financially motivated, with data breaches accounting for 64% of incidents and ransomware 36%. The financial sector was the second-most expensive industry for data breaches, at $5.56 million per breach.

AI is compounding the risk. Shadow AI accounted for 20% of AI-related breaches, and 97% of affected organizations lacked adequate access controls. Supply chain compromise reached systemic levels, with third-party involvement in 30% of financial-sector breaches.

With the EU's Digital Operational Resilience Act (DORA) now enforceable, financial institutions must demonstrate intelligence-led risk management, threat-led penetration testing on live systems, and robust third-party oversight.

Download the full report at filigran.io.

How can financial institutions prepare for DORA's threat-led penetration testing requirements?

DORA Articles 26 and 27 require intelligence-led penetration tests at least every three years on live production systems, with supervisors expecting measurable improvement across cycles. Filigran's XTM platform connects threat intelligence directly to attack simulation, enabling continuous, threat-led validation aligned with frameworks like DORA and CTEM.

How is ransomware targeting financial institutions differently?

Approximately 12.8% of B2B financial organizations experienced ransomware in 2025, with attackers increasingly combining encryption with data exfiltration in double-extortion tactics that trigger regulatory reporting obligations. Filigran's report found double-extortion is now the dominant ransomware tactic against financial institutions.

Why is third-party cyber risk now a systemic threat to financial institutions?

Third-party breaches like MOVEit continued to affect major banks into 2025, and the Bybit $1.5 billion theft exposed how supply chain weaknesses in transaction flows can lead directly to extreme loss. Filigran's research recommends continuous intelligence sharing and attack simulation across the vendor ecosystem.

Media Treble McKenzie Covell filigran@treblepr.com

View source version on businesswire.com:

The articles, information, and content displayed on this webpage may include materials prepared and provided by third parties. Such third-party content is offered for informational purposes only and is not endorsed, reviewed, or verified by Morningstar.

Morningstar makes no representations or warranties regarding the accuracy, completeness, timeliness, or reliability of any third-party content displayed on this site. The views and opinions expressed in third-party content are those of the respective authors and do not necessarily reflect the views of Morningstar, its affiliates, or employees.

Morningstar is not responsible for any errors, omissions, or delays in this content, nor for any actions taken in reliance thereon. Users are advised to exercise their own judgment and seek independent financial advice before making any decisions based on such content. The third-party providers of this content are not affiliated with Morningstar, and their inclusion on this site does not imply any form of partnership, agency, or endorsement.