Data-Driven Cybersecurity Risk Assessment in Digital Financial Services: A Mixed-Methods Analysis of Breach Patterns, Vulnerability Factors and Financial Impact, 2008–2025

Abstract

As financial services have moved online, banks, payment firms, lenders and crypto platforms have become major targets for cyberattacks, yet most research on cybersecurity in this area describes incidents without measuring patterns across them. In this study, I built a dataset of 47 publicly reported cyber incidents at digital financial service providers between 2008 and 2025, recording the type of firm, attack method, records exposed, financial loss and root causes of each, and analysed it with statistical tests and a content analysis of short incident narratives. Three patterns stand out. First, damage is highly uneven: three incidents account for almost 70% of the 1.69 billion records exposed. Second, among the documented incidents, the route of attack has shifted towards outside vendors and partners. Third-party involvement rose from no incidents before 2020 to half of the incidents in 2023–2025, and ransomware was the primary attack vector in five of the sixteen most recent cases. Third, crypto and decentralised finance (DeFi) platforms reported much larger losses, with a median of US$290 million compared with US$26 million for other firms (p = 0.005). Because the incidents were selected from public reporting and lean towards well-known cases, these results describe documented incidents rather than the full population of attacks, and most tests are exploratory. Based on the findings, I propose a five-stage risk assessment framework that firms could use to prioritise cyber risks, which still needs to be tested in practice.