addressed by service providers. ransomware one of these risks is from ransomware, which continues to be an prevalent threat to 1 / 6 bis - central bankers'speeches financial institutions. reports of these kinds of attacks have increased significantly over the past five years, with the financial crimes enforcement network ( fincen ) reporting more than 1, 400 ransomware - related bank secrecy act filings in 2021, worth nearly $ 1. 2 billion. this represents a nearly 200 percent increase over 2020 and coincides with elevated geopolitical risk. moreover, the frequency of ransomware attacks has escalated due to the emergence of ransomware - as - a - service, enabling easier deployment of these types of attacks. although ransomware impacts financial institutions of all sizes, it disproportionately impacts smaller banks that may not have sufficient resources to protect against these attacks. 2 ransomware is often delivered through phishing emails or through the unauthorized installation of malicious programs onto an organization's systems, known as " drive - bydownloads. " these tactics take advantage of those with access to a bank's internal systems, whose actions, while perhaps well - intentioned, enable the ransomware cyberattack to occur. according to the cybersecurity and infrastructure security agency, eight out of 10 organizations had at least one user fall for a phishing attempt, and one out of 10 phishing emails resulted in a user opening a malicious attachment or accessing a malicious internet link. 3 banks regularly perform exercises testing employee vulnerability to these kinds of targeted attacks. banks should continue efforts to educate those with systems access about these risks. ransomware attacks can be mitigated by bank management. by using a robust, formal risk assessment process, bank management can develop a comprehensive action plan to prevent a ransomware attack from occurring, or to reduce the impact on the bank should such an attack occur. banks that have planned ahead for a ransomware attack will be better positioned to respond when an attack occurs. use of internal and external applications software and public - facing applications are also potential targets for exploitation, requiring effective planning and implementation of patch management to address emerging and existing vulnerabilities. hackers constantly seek opportunities to exploit software holes and risks exist even with a bank's best efforts to install the most up - todate security patches. for example, often when vulnerabilities are identified, providers have not yet provided patches to address these issues, leaving the bank vulnerable to what is referred to as

security incident notification rule. the federal reserve continues to expect banks to report breaches of sensitive customer information consistent with applicable law. 7 the new service provider reporting requirement together with the fed's efforts to improve access to service provider reports should help to streamline small banks'efforts to monitor their technology service providers. the federal reserve system focus on cyber risk the financial system is deeply interconnected. as a result, the federal reserve coordinates with industry and a number of domestic and international agencies, governance bodies, and state and federal regulators to share information and best practices to prevent, detect, and recover from cyberattacks. these efforts enable the federal reserve to work closely with other regulatory agencies to issue consistent guidance and updated examination procedures on critical areas including it risk management and cybersecurity. of course, a critical element of the fed's focus on cybersecurity risk is the expectation that a bank will continue to develop internal expertise and build upon that expertise over time. similarly, the federal reserve is committed to ensuring that our supervision is well positioned with appropriate staffing, training, and resources to understand and effectively examine cyber risk. we recognize that expertise in this area is critical for our success as well, and the reserve banks have been actively recruiting seasoned cybersecurity and it specialists, while also working to develop in - house expertise. examiner training is frequently updated to align with current and emerging threats, and the federal reserve actively prepares examiners when new cyber risk management guidance is released. it examiners also get industry perspective through participating in external conferences and training events from cybersecurity experts and organizations. in short, the federal reserve is committed to ensuring that examiners are wellpositioned to supervise the efforts of state member banks and bank holding companies to address cyber - risks, and to provide more effective outreach and communication. 8 4 / 6 bis - central bankers'speeches today's workshop is just one of the many ways we engage with banks on cyber - related issues. because cyber threats evolve quickly, cybersecurity must be equally dynamic in its response. banks must continuously refine their risk management processes. we recognize the importance of regular communication and outreach through events like this one today. while we expect banks to be in touch with us when an event happens, cyber events should not be the first time a cyber - risk conversation occurs between a bank and its regulator. we look forward to working with you to assist in clarifying expectations, applying regulatory guidance or seeking feedback on