Company: INGVF
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001628280-25-010764
Chunk: 225

Company: ING GROEP NV
Filing Date: 2025-03-06
Form: 20-F
Item: Item 16K
Chunk 225
---
Item 16K. Cybersecurity
Introduction
Cybercrime remains a continuous threat to companies in general and to financial institutions in particular. Both the frequency and the intensity of attacks continue to increase on a global scale. The sophistication and implications of ransomware attacks are of particular concern in the threat landscape. Phishing or email-based social engineering attacks, usually used to initiate ransomware/malware infection or plant an info/password stealer for password reuse of valid accounts, or drive-by compromise attacks. Distributed denial of 

service attacks, against financial sector and digital services operators are used for reputational damage and/or extortion. There has been noticeable increase in supply chain attacks using compromised 3rd party vendors as a delivery of attack vectors. This includes abusing cloud misconfigurations to gain access to cloud infrastructure and application. 
The continuous enhancement of the control environment to protect from- and detect and respond to- distributed denial-of-service (DDoS), targeted attacks and more specific ransomware attacks is of the highest priority.
Based on regular scenario analysis done in ING’s first line of defence, additional defensive controls continue to be embedded in the organisation as part of the overall internal control framework and are continuously re-assessed against existing and new threats. 
The further digitalisation of banking services, increasing electronic exchange of information via different consumer channels, use of and dependency on third-party vendors for services, and the implementation of the EU Digital Operational Resilience Act (DORA) are likely to present ongoing cybercrime-resilience and IT-security challenges, both in the short and medium-term. Criminal actors are targeting financial and sensitive (payment) data, such as customer user credentials outside the traditional banking environment. Sensitive (payment) or personal data can be obtained by criminals via social forums such as Facebook and Linked-In.
IT and Cyber Risk Assessment and Reporting
To safeguard customer trust and to keep the bank secure the office of the Chief Information Security Officer (CISO) is predicting, preventing, detecting, and responding to threats and incidents. Secure architecture, engineering, and Identity and Access Management are preventive measures to define, implement and review components that mitigate the risk of unauthorised access to IT systems and the data processed and stored therein. Security detection and Response functionality is implemented to identify and provide timely alerts of malicious behaviour. Cyber threat assessments delivers awareness about new and existing threats and vulnerabilities targeting ING infrastructure. 
ING continues to invest in cybersecurity capabilities in all domains (prediction, prevention, detection, response, and recovery). 
Different types of cyberthreats are