Eight-day cyberattack highlights risks for Cyprus financial firms - Cyprus Mail
A distributed denial-of-service (DDoS) attack on a Cypriot bank lasted 200 hours in the third quarter of 2026, according to cybersecurity company Qrator Labs.
The attack lasted more than eight days, making it significantly longer than any incident recorded by Qrator Labs during 2025 and more than 2.5 times the duration of the longest attack observed in the previous quarter.
The incident highlights the growing threat to the financial sector, particularly in Cyprus, which has established itself as a hub for online trading, brokerage and financial services.
Financial institutions are increasingly expected to demonstrate that their systems can withstand serious cyber incidents and recover effectively.
Fintech most targeted sector
Qrator Labs’ latest global report found that financial technology (fintech) remained the most targeted sector, accounting for 31.3 per cent of all recorded DDoS attacks during the third quarter.
E-commerce followed with 19 per cent of attacks, while information and communication technology accounted for 18.2 per cent, meaning the three sectors together represented more than two-thirds of the incidents observed.
Financial institutions are particularly attractive to cybercriminals because they deal with money. But attackers rarely distinguish between business models. Even a payment provider that simply processes transactions and earns a commission may be perceived as a lucrative target.
Rising scale of botnets
The scale of DDoS attacks is also increasing, with Qrator Labs reporting that the largest botnet it observed reached 3.56 million devices in the third quarter, up by around 70 per cent from 2.09 million in the second quarter.
A botnet is a network of compromised devices that attackers can control remotely and use to overwhelm websites, applications and other online services with traffic, potentially making them unavailable to legitimate users.
The latest increase followed a sharp decline earlier in the year after an international law enforcement operation targeted major botnets, but the rapid rebound suggests the disruption may have had only a temporary effect.
Millions of poorly secured connected devices remain available for attackers to exploit because they receive few or no security updates, and AI tools are making it increasingly easy to compromise them at scale.
Regulatory pressure grows
The report comes amid growing regulatory attention to operational resilience and compliance with the European Union’s Digital Operational Resilience Act (DORA), which sets requirements for financial firms to manage information and communication technology risks.
At the 6th Cyber Security Conference in September 2026, Christos Meletiou of the Central Bank of Cyprus stressed that financial institutions must go beyond formal compliance with DORA and demonstrate that their security and recovery arrangements work in practice.
Also in September, the Cyprus Securities and Exchange Commission (CySEC) introduced new reporting requirements under DORA, requiring investment firms, crypto-asset service providers, trading venues and other regulated financial entities experiencing major information and communication technology incidents to calculate and report the resulting annual costs and losses.
The rules require affected firms to quantify the financial impact of serious disruptions and submit the findings to the regulator, adding to the pressure on institutions to understand the consequences of incidents and maintain effective response arrangements.
Need for sustained resilience
The ability of attackers to rebuild their infrastructure posed a further challenge, even when law enforcement agencies managed to disrupt large networks.
Even when international law enforcement efforts, which remain few and far between, disrupt major botnets, their operators can rebuild the infrastructure within months.
As long as attackers can exploit these devices to rebuild their networks, financial institutions must be prepared for prolonged and potentially repeated attacks.
For financial organisations, the challenge is therefore not limited to preventing attacks, but also ensuring that essential services remain available when attacks continue for extended periods or recur after systems have been restored.
Qrator Labs said these trends reinforced the need to treat DDoS protection as part of wider operational resilience, with financial institutions focusing on their ability to maintain critical services during sustained attacks rather than concentrating solely on preventing individual incidents.
Related
