steven maijoor : cyber resilience in an age of geopolitical tensions speech by mr steven maijoor, executive director of supervision of de nederlandsche bank, at the annual fintech and regulation conference, brussels, 4 february 2025. * * * on december 12th 2023, kyivstar, ukraine's largest telecom provider, suffered a cyberattack that disrupted services for millions of users. the attack, attributed to the russian state - sponsored group sandworm, was one of the biggest cyber incidents in ukraine since the onset of the russian invasion. the hackers had infiltrated kyivstar's infrastructure months earlier. they deployed malware that erased thousands of virtual servers and personal computers, crippling the company's network for managing communication services. the attack had several immediate effects. first of all, approximately half of kyivstar's network was disabled, leaving millions without mobile and internet connection. but the damage wasn't limited to the telecom sector. the attack also disrupted banking operations, payment processing, and online banking services. some atms and point - ofsale terminals didn't work. financial transactions were in disarray across the country. amazingly, the ukrainians were quickly able to restore services. over the past three years they have become quite proficient in dealing with large - scale disruption. many critical processes in ukraine are equipped with redundancy measures. many people even have two sim cards in their phones. that enabled the other ukrainian telecom providers to circumvent the outage. services at kyivstar were gradually reinstated, with almost full restoration achieved eight days after the attack. this episode raises some inconvenient questions. what if this would happen to us? what if a large scale russian or chinese cyberattack is launched on the telecoms sector of an eu member state? would it be possible? how much damage could such an attack cause? would it affect financial services? and would we be able to recover as quickly as the ukrainians did? a few years ago, most people would have found these questions to be rather hypothetical, but today, unfortunately, they have become quite urgent. geopolitical tensions have been rising for more than a decade, but over the past few years they have accelerated. countries are re - arming, they are protecting their strategic economic infrastructures, they are imposing trade restrictions and sanctions on each other, and they are weaponising access to international financial infrastructures and services. needless to

is one of the better digitally defended sectors in the economy. as it should be. but given the size and urgency of the threat, we need to do even more to keep financial services safe. this is why cyber resilience will absolutely be a key focus area in our supervision of the financial industry in the coming years. this goes both for de nederlandsche bank, and for the european central bank. our aim is to make financial services safer against cyber threats. not only by increasing the resilience of the financial sector itself, but also by stepping up the robustness of the entire chain of ict service providers. dora, the european digital operational resilience act, that came into effect at the beginning of this year, gives us additional tools to accomplish this aim. to start with, under dora, threat - led penetration tests are mandatory for the largest financial institutions in europe. in the netherlands we have been conducting these kinds of tests voluntarily for over eight years with good results, and we are very pleased that it is now becoming the norm at the european level. but dora also imposes stricter requirements for managing cyber risks in outsourcing chains. for example, financial firms face stricter rules for conducting due diligence on potential ict providers. as a result, fintechs may also experience more stringent due diligence from financial sector customers. and very importantly, under dora, european supervisors can conduct inspections of critical third - party ict service providers in tandem with national supervisory authorities. we expect bigtechs like google and microsoft to be placed under eu - wide supervision. and, just as with the banks, we are going to test their readiness to detect and withstand cyberattacks. 2 / 4 bis - central bankers'speeches despite all efforts, there is no such thing as perfect cyber security. it is therefore vital that financial institutions take measures to recover quickly after cyber incidents. this is crucial to ensure that services can continue and people don't lose trust in financial firms or the financial sector as a whole. the results of the ecb's 2024 cyber stress test show that there is room for improvement on the recovery front. so it's a very good thing that dora also imposes new requirements on institutions'continuity plans and backup policies. they need to develop a culture where cyber incidents are quickly detected and reported, they need to have their playbooks in place and they need to have clearly defined management roles and responsibilities. these are key ingredients for